攻击名称

整数溢出(上溢和下溢)

攻击分类CWE-682

计算不正确

攻击描述

当算数运算达到改类型的最大或最小值时，就是出现溢出。比如uint8类型，它的取值范围为0-2^8-1,当运算时尝试创建一个超出该类型可描述范围的值时，就会出现整数溢出。

合约案例

完整代码和文档.

减法下溢、加法上溢和乘法下溢

// SPDX-License-Identifier: GPL-3.0pragma solidity ^0.6.10;contract Overflow {    uint8 public count = 1;    function set(uint8 _count) public {        count = _count;    }    function sub(uint8 input) public {        count -= input;    }    function mul(uint8 input) public {        count = 255；        count *= input;    }    function add(uint8 input) public {        count = 255;        count += input;    }}

分别运行sub,mul和add函数，会发现与预期结果不一致。

防止策略

检查预期结果是否一致。

contract FixOverflow {    uint8 public count = 1;    function set(uint8 _count) public {        count = _count;    }    function sub(uint8 input) public {        count = sub(count, input);    }    function mul(uint8 input) public {        count =  mul(count,input);    }    function add(uint8 input) public {        count = 255;        count = add(count, input);    }    function sub(uint8 a, uint8 b) internal pure returns (uint8) {        require(b <= a, "Underflow!");        return a -b;    }    function add(uint8 a, uint8 b) internal pure returns (uint8) {        uint8 c = a + b;        require( c>=a, "Overflow!");        return c;    }    function mul(uint8 a, uint8 b) internal pure returns (uint8) {        if (a == 0) {            return 0;        }        uint8 c = a *b;        require( c / a == b, "Overflow!");        return c;    }}

或直接使用openzeppelin数学库。

pragma solidity ^0.8.0;import "https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/math/SafeMath.sol"; //[Remix环境]contract FixedOverflow {    uint256 public count = 1;    function set(uint256 _count) public {        count = _count;    }    function sub(uint256 input) public {        count = SafeMath.sub(count, input, "Overflow!");    }    function mul(uint256 input) public {        count = 2**256 -1;        count =  SafeMath.mul(count,input);    }    function add(uint256 input) public {        count = 2**256 -1;        count = SafeMath.add(count, input);    }}