Signed/unsigned arithmetic confusion
Across Protocol's assessment for RD-F-018 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No confirmed signed/unsigned confusion finding in any OZ audit across 18 engagements for deployed EVM contracts. SpokePool uses `uint32` for depositId, `uint256` for amounts — standard unsigned types. The SVM audit found cost asymmetry issues but those are in Rust/Solana.
Sources #
- URLhttps://www.openzeppelin.com/customer-stories/acrossretrieved 2026-04-28
Methodology #
Determine whether signed-integer conversions or comparisons where unsigned was intended exist in the deployed bytecode/source.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol across-protocol factor RD-F-018 score green collected_at 2026-04-30 21:19:18