Detect Go’s silent arithmetic bugs with go-panikint

Summary: Trail of Bits released go-panikint, a modified Go compiler that inserts runtime checks during conversion to Static Single Assignment form, turning silent integer overflows into explicit panics. Using it in a fuzzing campaign against the Cosmos SDK, they found an integer overflow in the RPC pagination logic where offset plus limit exceeding the uint64 maximum returned an empty validator list; the issue is unfixed but a pull request has been created to mitigate it.
What's compelling: Go's default wraparound behavior has hidden an entire class of security vulnerabilities from fuzzing campaigns, and the Cosmos SDK overflow shows a live query path where an unchecked sum silently changed results rather than crashing.

Read the original at Trail of Bits Blog ↗