Skip to content
medium Arithmetic SWC-101 CWE-704

Unsafe Type Casting / Downcast Truncation

SAFE-0030 Arithmetic Checked automatically by the scanner
1

What goes wrong

Casting a larger integer to a smaller type (uint256->uint128/uint64) silently truncates high-order bits, corrupting amounts, timestamps, or IDs.

2

How to fix it

the pattern that is safe
using SafeCast for uint256;
uint128 amt = amount256.toUint128();  // reverts on overflow
◆
Use OpenZeppelin SafeCast.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$223M · 2025 Cetus Protocol Arithmetic · 2025 $147M · 2021 Compound Finance Arithmetic · 2021 $128M · 2025 Balancer v2 Arithmetic · 2025 ~$50M · 2021 Uranium Finance Arithmetic · 2021
4

Related vulnerabilities in Arithmetic

SAFE-0016Integer Overflow / Underflow (pre-0.8 or unchecked) critical · Arithmetic SAFE-0018Rounding Error Exploitation high · Arithmetic SAFE-0084Incorrect Decimal / Token Unit Handling high · Arithmetic SAFE-0017Division Before Multiplication Precision Loss medium · Arithmetic SAFE-0121unchecked{} Block Hiding Over/Underflow medium · Arithmetic SAFE-0122Unsafe Downcast (uint256 → smaller) medium · Arithmetic SAFE-0219Reward-Per-Token Precision Loss medium · Arithmetic SAFE-0087Dust Accumulation / Rounding Residue Lockup low · Arithmetic
← PreviousArbitrary External Call Injection
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0030 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs