integer-issues

# Integer issues detection ## When this applies - `unchecked { … }` blocks (Solidity ≥0.8) - Downcasts: `uint128(x)`, `int256(uint256(x))`, `uint8(...)` - Division and modulo - Fixed-point math with custom decimal scales - Share/asset math in vaults, lending, AMMs - Pre-0.8 Solidity code (no built-in overflow checks) - Vyper code with unbounded loops - Inline assembly arithmetic ## Detection patterns ### Unchecked overflow on user input (HIGH) ```solidity unchecked { balance[to] += amount; // ← if amount controlled, can overflow back to 0 } ``` `unchecked` is fine for proven-safe accumulators (e.g. `++i` in bounded loops), not for value math. ### Division before multiplication (HIGH) ```solidity uint256 fee = (amount / 100) * feeBps; // ← truncation; do (amount * feeBps) / 100 ``` ### Decimal mismatch (HIGH) USDC = 6 decimals, WETH = 18, WBTC = 8. Mixing without scaling produces silent 1e10–1e12 errors. ```solidity uint256 wethValue = amountUsdc * price; // ← USDC 6dp × price 8dp = 14dp, need 18dp ``` ### Downcast loss (HIGH) ```solidity uint128 sharesU128 = uint128(shares); // ← silently truncates if shares > 2^128 ``` Use OZ `SafeCast`. ### Fixed-point precision loss (HIGH) Compounding interest done as `principal * (1 + rate)^t` with too-few-decimal `rate`. Use ray (1e27) or wad (1e18) math via PRBMath / Solady. ### Round-direction asymmetry (HIGH for vaults) ERC-4626 must round shares *down* on deposit (favor vault) and *up* on withdraw (favor vau...