Integer Overflow Pattern Scanner (Pre-0.8 Contracts)

WHAT IT DOES

Integer Overflow Pattern Scanner analyzes Solidity source code from versions prior to 0.8.0 to identify arithmetic operations that may overflow or underflow. The tool scans for raw addition, subtraction, multiplication, and division operators that are not protected by SafeMath library calls, unchecked blocks, or other safety mechanisms. It flags each occurrence with its severity level (High, Medium, Low, or Info), shows the exact line and code snippet, and provides a remediation suggestion. The tool also detects whether the contract imports or uses SafeMath, whether it uses unchecked blocks (which suppress overflow checks even in 0.8+), and infers the compiler version from the pragma statement or accepts a user-provided version. This is specifically designed for legacy codebases that predate Solidity's built-in overflow protection.

HOW TO USE

Paste the Solidity source code into the text area. Optionally, enter the compiler version (e.g., 0.7.6) to help the tool determine if the contract is pre-0.8. The tool automatically detects the pragma statement if present. Enter the contract address (optional) to verify the contract exists on-chain. Click "Scan for overflows" to begin the analysis. The results display a summary of the contract's compiler version, SafeMath usage, and unchecked block usage, followed by a list of findings sorted by severity. Each finding includes the line number, a description of the potential overflow, the pattern detected, and a concrete suggestion for remediation.

THE REAL MECHANISM — why this beats a simple grep

A basic grep for "+" or "-" would flag every arithmetic operation, including those in 0.8+ contracts where overflow is impossible. This tool performs a context-aware scan that first detects the compiler version from the pragma statement or user input, then only flags operations that are genuinely risky. It distinguishes between raw arithmetic operators and SafeMath function calls (e.g., .add(), .sub(), .mul(), .div()), treating SafeMath-wrapped operations as safe. It also detects unchecked blocks, which explicitly disable overflow checks in Solidity 0.8+ and may indicate intentional overflow behavior, and adjusts severity accordingly. The scanner also filters out comments and string literals to avoid false positives. The output is categorized by severity: High for raw arithmetic in pre-0.8 contracts without SafeMath, Medium for arithmetic in contracts with SafeMath but not using it consistently, Low for operations inside unchecked blocks, and Info for version detection warnings. This allows developers to prioritize the most dangerous findings first.

WHAT IT CANNOT SEE

- Cannot detect overflow vulnerabilities that depend on complex state interactions or cross-function data flow — the tool only analyzes individual lines.

- Cannot distinguish between safe arithmetic (e.g., operations on variables that are known to be within bounds) and unsafe operations without full semantic analysis.

- Cannot detect overflows in inline assembly or low-level EVM opcodes that bypass Solidity's safety checks.

- Cannot analyze contracts that use Solidity 0.8+ with built-in overflow checks — the tool is specifically designed for pre-0.8 code.

- Cannot prove that flagged operations are actually exploitable — a finding is a warning, not a proof of vulnerability.

- Cannot analyze contracts without source code — bytecode analysis alone cannot detect overflow patterns.

- Cannot detect overflows in external library calls or inherited contracts not included in the source.

PLEASE NOTE

This tool works exclusively with Solidity source code on EVM-compatible chains. It does not support Vyper, Huff, Yul, or non-EVM languages. The tool is read-only and does not send transactions. No data is stored remotely; all analysis happens in your browser. Findings are heuristic and may include false positives or false negatives — always manually review any flagged code. For pre-0.8 contracts, the recommended mitigation is to use the SafeMath library or upgrade to Solidity 0.8+ with automatic overflow protection. Use this tool as a triage aid, not as a substitute for professional security review.