input-arithmetic-safety

To audit smart contract arithmetic vulnerabilities, you need to detect missing zero-address checks, precision loss from division-before-multiplication, unsafe integer casting, and ERC4626 share inflation risks. This Skill systematically analyzes Solidity code to identify these flaws.

Common input validation vulnerabilities in DeFi smart contracts include missing zero-address checks, unvalidated user-supplied amounts, improper parameter ranges, and array bounds issues. These flaws allow attackers to manipulate protocol logic and cause fund loss.

Solidity 0.8+ unchecked blocks disable built-in overflow checks, creating edge cases where arithmetic operations can silently wrap around. Auditing unchecked blocks is critical to identify vulnerabilities that bypass default safety checks and lead to unexpected behavior.

Yes, it detects ERC4626 vault share inflation attacks and rounding direction exploitation by analyzing share pricing and exchange rate logic. It identifies mathematical edge cases where attackers can manipulate rounding to extract value from the protocol.

You should audit for precision loss in fee calculations whenever contracts perform division before multiplication, handle dust amounts, or apply exchange rates. These operations frequently introduce rounding errors that attackers exploit to drain protocol funds.

Yes, this Skill is specifically designed to audit public-facing functions that accept user input. It validates parameter ranges, array bounds, and amount checks to ensure external calls cannot exploit arithmetic logic or bypass protocol constraints.