2026-07-28

# ADD having no overflow protection is hillarious

Disclaimer
 - personal
 - target audience - strictly myself

Main
 - Finally doing some actual work lol
 - The important part - load the phrase "curiosity about how EVM works" into your working memory.

> This behavior, combined with Solidity’s historical lack of built-in overflow protection (pre-0.8.0), made integer overflow the single largest class of smart contract vulnerabilities from 2016 to 2020, responsible for hundreds of millions in losses.

 - [Link to source](https://krash.dev/evm-tm/OpCodes-Threat-Models/0x01-ADD)
 - Spent 30 seconds just staring at this sentence and laughing

---

update

> When a proxy contract uses delegatecall to forward execution to an implementation contract, and that implementation is destroyed (via SELFDESTRUCT) or was never deployed, the delegatecall targets address with no code. The EVM executes STOP, returning success. The proxy now silently does nothing for every call, permanently bricking itself.

 - [Link to source](https://krash.dev/evm-tm/OpCodes-Threat-Models/0x00-STOP#t1-delegatecall-to-emptydestroyed-contract-critical)
 - What the fuck lmao. Whoever designed the EVM is completely insane. I mean I get it, they didn't think about smart contract security back in 2016, but still. 
 - I did not know the state of smart contract security is this bad. Finally starting to understand why it is like this.