I just finished the Token Level in Zeppelin's Ethernaut and in the end they explained that overflows are very common in solidity. I didn't even think about overflows, I just tried to steal the tokens.

This is the code they show:

Overflows are very common in solidity and must be checked for with control statements such as:

if(a + c > a) {
a = a + c;

An easier alternative is to use OpenZeppelin's SafeMath library that automatically checks for overflows in all the mathematical operators. The resulting code looks like this:

 a = a.add(c);

If there is an overflow, the code will revert.

I just can't understand what overflows in solidity are, can someone please give me a newbie explanation about what they are or point me an article where to look at. Thanks!


From https://programtheblockchain.com/posts/2018/04/27/avoiding-integer-overflows-safemath-isnt-enough/:

Fixed-size integers have a range of values they can represent. For example, an 8-bit unsigned integer can store values between 0 and 255 (2^8-1). When the result of some arithmetic falls outside that supported range, an integer overflow occurs. On the Ethereum Virtual Machine (EVM), the consequence of an integer overflow is that the most significant bits of the result are lost. For example, when working with 8-bit unsigned integers, 255 + 1 = 0. This is easier to see in binary, where 1111 1111 + 0000 0001 should be 1 0000 0000, but because only 8 bits are available, the leftmost bit is lost, resulting in a value of 0000 0000.

Intuitively, the effect of an integer overflow can be thought of as the value “wrapping around.”

  • Thanks a lot @smarx, great article, just what I needed
    – user47673
    Nov 27 '18 at 17:50

An overflow is when the result of a binary operation (i.e., an operation with two operands), does not fit into the type of the operands (the larger type, if they are not identical).

For example:

uint8 a = 43;
uint16 b = 65500;
uint32 c = a + b;

In the above code, the result should be that c is set to 65543.

The type of c can represent this value correctly, but the result of a + b is computed into uint16 (the larger type of a and b), which cannot represent this value correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy