overflow-safety

OVERFLOW_SAFETY Skill (Soroban)

Trigger Pattern: Always required for Soroban audits Inject Into: Breadth agents, depth-edge-case Finding prefix: [OF-N] Rules referenced: R10, R14

Soroban contracts are compiled Rust. Rust's overflow behavior depends on the build profile: in debug builds, overflows panic; in release builds (used for deployment), overflows silently wrap by default unless overflow-checks = true is set. Silent wrapping in financial arithmetic is a critical vulnerability.

1. Profile Check

Before tracing any arithmetic, inspect Cargo.toml for the release profile overflow setting:

File	[profile.release] Present?	overflow-checks Setting	Safe?
Cargo.toml	YES/NO	true / false / MISSING	Only if true

Interpretation:

• overflow-checks = true → all integer arithmetic panics on overflow in release builds. The codebase is safe from silent wrapping.
• overflow-checks = false or missing → overflows silently wrap in release. Proceed to Section 2.
• If the file does not exist or does not contain [profile.release]: treat as false (Rust default for release).

Finding threshold: If overflow-checks is not true, the entire overflow safety of the contract depends on manual use of checked/saturating arithmetic. This is a configuration-level finding regardless of whether Section 2 finds specific overflow sites.

2. Arithmetic Trace (if overflow-checks is false/missing)

If the profile check from Section 1 found that overflow protection is NOT enabled, trace ALL arithmetic operations in financial paths:

Location	Expression	Operand Types	Max Realistic Value	Overflow Possible?	Impact if Wrapped
{file:line}	{a + b}	u64 / i128 / u32	{estimate}	YES/NO	{balance wraps to 0, share inflates, etc.}