Writeups/Ethernaut/Token
EasyEthernaut · Ethernaut2024

Token

Integer Underflow (pre-SafeMath)

The `transfer()` function uses an unchecked subtraction. Sending more tokens than the balance causes an integer underflow, wrapping the balance to `2^256 - 1`.

SolidityInteger UnderflowArithmeticERC20

00Overview

The `transfer()` function uses an unchecked subtraction. Sending more tokens than the balance causes an integer underflow, wrapping the balance to `2^256 - 1`.

01Trigger underflow

Transfer an amount exceeding balance to any address.

javascript
await contract.transfer("0xdeadbeef...", 21)
// balance was 20; 20 - 21 underflows to 2^256 - 1

02Level Completed

Token — completion screenshot 1