溢位、下溢與那些會搬動金錢的取整漏洞

// Solidity 0.7 — UNSAFE: arithmetic wraps silently, no revert
mapping(address => uint256) public balanceOf;

function transfer(address to, uint256 amount) external {
    // No check that you actually own `amount`.
    balanceOf[msg.sender] -= amount;   // <-- can underflow
    balanceOf[to]         += amount;
}

function batchTransfer(address[] _receivers, uint256 _value) public returns (bool) {
    uint cnt = _receivers.length;
    uint256 amount = uint256(cnt) * _value;          // <-- OVERFLOWS
    require(cnt > 0 && cnt <= 20);
    require(_value > 0 && balances[msg.sender] >= amount);  // passes!
    balances[msg.sender] = balances[msg.sender].sub(amount);
    for (uint i = 0; i < cnt; i++) {
        balances[_receivers[i]] = balances[_receivers[i]].add(_value);
    }
    return true;
}

library SafeMath {
    function add(uint256 a, uint256 b) internal pure returns (uint256) {
        uint256 c = a + b;
        require(c >= a, "SafeMath: addition overflow");  // if it wrapped, c < a
        return c;
    }
    function sub(uint256 a, uint256 b) internal pure returns (uint256) {
        require(b <= a, "SafeMath: subtraction underflow"); // refuse to go below 0
        return a - b;
    }
    function mul(uint256 a, uint256 b) internal pure returns (uint256) {
        if (a == 0) return 0;
        uint256 c = a * b;
        require(c / a == b, "SafeMath: multiplication overflow"); // undo and compare
        return c;
    }
}

// Solidity ^0.8.0
uint8 x = 255;
x = x + 1;     // REVERTS with Panic(0x11) — does NOT wrap to 0

// A legitimate `unchecked`: the loop index is bounded by the array length,
// so ++i cannot reach 2^256. Skipping the check saves gas every iteration.
function sumAll(uint256[] calldata xs) external pure returns (uint256 total) {
    for (uint256 i = 0; i < xs.length;) {
        total += xs[i];          // still CHECKED — a real sum could overflow
        unchecked { ++i; }       // safe to skip the check here
    }
}

// These are NOT equal in integer math:
uint256 a = 100; uint256 b = 1000; uint256 c = 3;

uint256 wrong = a / b * c;   // (100 / 1000) * 3 = 0 * 3   = 0
uint256 right = a * c / b;   // (100 * 3)  / 1000 = 300 / 1000 = 0  (still 0 here)

// With a = 100_000:
// a / b * c = 100 * 3            = 300
// a * c / b = 300_000 / 1000     = 300   (same, but loses no precision early)

// RULE: multiply before you divide, so the big intermediate keeps the precision.
// Beware: a * c can itself overflow — use a full-precision mulDiv for large values.

// shares minted for a deposit, rounding DOWN:
function deposit(uint256 assets) external returns (uint256 shares) {
    shares = totalSupply == 0
        ? assets                                   // first depositor: 1:1
        : assets * totalSupply / totalAssets();    // <-- rounds down, can hit 0
    require(shares > 0, "zero shares");            // <-- the missing guard
    _mint(msg.sender, shares);
    token.transferFrom(msg.sender, address(this), assets);
}

// Foundry fuzz test (Solidity). `amount` is randomized over the whole uint range,
// shrinking automatically toward the smallest counterexample on failure.
function testFuzz_NoFreeValue(uint256 amount) public {
    amount = bound(amount, 1, 1_000_000e18);
    uint256 shares = vault.deposit(amount);
    uint256 out    = vault.redeem(shares);
    assertLe(out, amount, "INVARIANT BROKEN: redeemed more than deposited");
}