Crypto glossary
Integer overflow and rounding bugs
Integer overflow and rounding bugs are arithmetic flaws in smart contracts, where numbers wrap around or lose precision in ways attackers can exploit.
Smart contracts work with fixed-size integers and no decimals. An overflow happens when a calculation exceeds the maximum value and wraps to a small number; an underflow does the opposite, turning a tiny balance into an enormous one. Rounding bugs come from integer division, which always truncates, so the order of multiplications and divisions and the direction of rounding decide who gains the leftover fractions.
Overflows caused several early token disasters, such as the 2018 batchOverflow bug that let attackers mint huge amounts of BeautyChain tokens. Since Solidity 0.8, released in late 2020, arithmetic reverts on overflow by default, so the classic form is rare in new code, though unchecked blocks and other languages can reintroduce it. Precision exploits have taken its place: attackers manipulate share prices in empty vaults or lending markets so that rounding works in their favour, as in the Hundred Finance exploit of 2023 and the inflation attacks against ERC-4626 vaults.
A rounding error of one unit looks harmless, but repeated thousands of times in a loop, or applied to a manipulated exchange rate, it can drain a protocol. Audits now check rounding direction systematically.
Example
An attacker deposits one wei into a new vault, donates a large amount directly to inflate the share price, and the next depositor's shares round down to zero, handing the deposit to the attacker.