Skip to content
THREATWIRE

DeFi Security · Vulnerability class

Arithmetic, overflow and rounding

Numbers that do not fit their type, or that are cut or rounded in the wrong direction, create value that does not exist.

DatabaseIncidentsChainsProtocolsVulnerabilities

The concept

Truncation, overflow and rounding errors are small on their own and decisive when an attacker can repeat or choose the inputs.

Defensive lessons

  • Use checked arithmetic and reject values that do not fit.
  • Check both sides of a trade.
  • Round in the protocol's favour and test the edges.

Stored incidents