Is this transfer functions code vulnerable to integer overflow?

Question

I have been doing some bug hunting on etherscan.io and have come across many contracts with this kind of code. Specifically, the ones that don't use safe math library, are older then solidity 0.8, and don't explicitly check for overflows. Could someone please tell me if this code is okay and safe or should it be flagged in an audit as vulnerable. If it is vulnerable what is the severity and can it be used to compromise the token balances of the smart contract.

function transfer(address _to, uint256 _value) returns (bool success) {
        require(balances[msg.sender] >= _value);
        balances[msg.sender] -= _value;
        balances[_to] += _value;
        Transfer(msg.sender, _to, _value);
        return true;
    }

Thanks in advance.

Answer 1

Since solidity 0.8 there are built in checks for overflows. Check the documentation.

Checks for overflow are very common, so we made them the default to increase readability of code, even if it comes at a slight increase of gas costs.

To your question - yes the code is save.

Answer 2

To complete Hristo, if <0.8 then Since you made a check with require you avoid underflow.

For overflow, the risk is low because you are on Uint256, but it exists.

Answer 3

This code does check for underflows, that's the purpose of the require statement in the first line. If that require statement wasnt there i could transfer slightly more tokens than what i have, making my balance underflow and setting it to a very high number.

However, this code doesnt check for overflows on _to's balance. So if _to's balance was nearing the max value for an uint256, i could transfer a certain amount and make it wrap around back to zero. I assume whoever wrote this code assumed it was unnecessary because it would be impossible to have someone with such a high balance in real world conditions.