Signed/unsigned arithmetic confusion

Evidence summary #

Vyper uses explicit integer types (uint256, int256) with no implicit signed/unsigned confusion; implicit casts are compile-time errors. No public audit finding flags signed/unsigned confusion in NG contracts. Vyper's type system structurally prevents this class of error.

Sources #

Methodology #

Determine whether signed-integer conversions or comparisons where unsigned was intended exist in the deployed bytecode/source.

See the full factor methodology and distribution across all protocols →