Sigvex
EVMExploit4 min read

Integer Overflow Exploit Generator

Sigvex exploit generator that validates unchecked arithmetic vulnerabilities by supplying maximum uint256 values and checking whether the execution reverts.

evminteger-overflowexploit-generator

Integer Overflow Exploit Generator

Overview

The integer overflow exploit generator validates findings from the integer_overflow detector by executing the target contract with 2^256 - 1 (the maximum 256-bit unsigned integer) as the primary parameter and observing whether the execution reverts. Contracts compiled with Solidity >=0.8.0 or using the SafeMath library should revert on overflow; contracts compiled with earlier Solidity versions that use unchecked arithmetic will silently wrap around.

Integer overflow bugs were the dominant vulnerability class before Solidity 0.8.0 introduced automatic revert-on-overflow. Historical examples include the BECToken (BatchOverflow) exploit (2018), where an overflow in token quantity allowed attackers to mint tokens worth billions of dollars in seconds.

Note: Exploit generation in Sigvex is for vulnerability validation purposes only.

Attack Scenario

Overflow (addition):

  1. A token contract stores uint256 balance. The contract uses Solidity <0.8.0 without SafeMath.
  2. The attacker calls transfer(address, uint256) with amount = type(uint256).max.
  3. The contract computes balances[recipient] += amount. With the attacker’s tiny existing balance, this wraps around to a small value, but the arithmetic preceding it can bypass balance checks.
  4. Impact: The attacker transfers more tokens than they own, or sets another account’s balance to an arbitrary value.

Underflow (subtraction):

  1. A contract tracks user deposits with uint256 balances.
  2. The attacker calls withdraw(amount) with amount slightly greater than their balance.
  3. Without an underflow check, balances[msg.sender] -= amount wraps from 0 to type(uint256).max.
  4. The attacker effectively has an infinite token balance.

Exploit Mechanics

The generator constructs the following execution:

  1. Calldata construction: The transfer(address,uint256) selector (0xa9059cbb) is used unless the finding provides a specific function location.
  2. Overflow parameter: 2^256 - 1 (the maximum uint256 value) is ABI-encoded and appended to the calldata. This is the value most likely to trigger a wrap-around.
  3. Execution: The contract bytecode is executed with the constructed calldata.
  4. Verdict:
    • Reverted → SafeMath or Solidity >=0.8.0 protection is in place (not exploitable at this level).
    • Completed without revert → overflow protection is absent (confidence 0.75).
    • VM error containing “overflow” string → protection detected.

Separately, the generator tests an underflow scenario by tracking that "underflow_test" = "0 - 1" is recorded in the inputs map.

The generated PoC targets the older Solidity version explicitly:

pragma solidity ^0.7.6; // Older version without checked arithmetic

interface IVulnerableToken {
    function transfer(address to, uint256 amount) external returns (bool);
    function balanceOf(address account) external view returns (uint256);
}

contract OverflowAttacker {
    // Trigger addition overflow: send max uint256 to inflate recipient balance
    function exploitAdditionOverflow(address token, address victim) external {
        IVulnerableToken t = IVulnerableToken(token);
        // With Solidity <0.8.0: balances[victim] + type(uint256).max wraps to near-zero
        // depending on existing balance — demonstrates the silent wrap
        t.transfer(victim, type(uint256).max);
    }

    // Trigger underflow: withdraw more than balance, wrapping to uint256.max
    function exploitUnderflow(address token) external {
        IVulnerableToken t = IVulnerableToken(token);
        uint256 myBalance = t.balanceOf(address(this));
        // If contract does not check balance >= amount, this wraps to max
        t.transfer(address(this), myBalance + 1);
        // After: balanceOf(this) == type(uint256).max (overflow of uint256)
    }
}

Remediation

Upgrade to Solidity >=0.8.0, which reverts on overflow/underflow by default:

// VULNERABLE (Solidity <0.8.0 without SafeMath)
function transfer(uint256 amount) external {
    balances[msg.sender] -= amount; // silently wraps if amount > balance
}

// SECURE (Solidity >=0.8.0 — automatic checked arithmetic)
function transfer(uint256 amount) external {
    balances[msg.sender] -= amount; // reverts if amount > balance
}

// SECURE (Solidity <0.8.0 with SafeMath)
using SafeMath for uint256;
function transfer(uint256 amount) external {
    balances[msg.sender] = balances[msg.sender].sub(amount); // reverts on underflow
}

For performance-critical sections in Solidity >=0.8.0, use unchecked{} blocks only when the arithmetic is provably safe with explicit precondition checks.

References