Signed/unsigned arithmetic confusion

Evidence summary #

Solidity 0.8.19/0.8.20 with default overflow protection (SafeMath built-in). No signed/unsigned confusion vulnerability documented in any audit. Pashov Oct 2024 (USDtb scope) found L-03 EIP712 type mismatch uint128/uint120 in UStbMinting, but this is the USDtb sub-product and is out of core USDe scope.

Sources #

Methodology #

Determine whether signed-integer conversions or comparisons where unsigned was intended exist in the deployed bytecode/source.

See the full factor methodology and distribution across all protocols →