Lack of overflow-checks=true in contracts

[tkowalczyk]

I am wondering why in the for example cw-20 contract in Cargo.toml file the flag overflow-checks is not set to true this is important from security perspective.

[ethanfrey]

It is important.

However, you cannot set the profile inside the individual workspace, but rather in the global space.

We do set it here: https://github.com/CosmWasm/cosmwasm-plus/blob/main/Cargo.toml#L63

(Add have other blocks to add some compiler flags for contracts to get deterministic builds, that we don't need for packages)

[ethanfrey]

It is also set in the template contract. https://github.com/CosmWasm/cosmwasm-template/blob/master/Cargo.toml#L27

I agree it is quite important. Even if the Uint128 type now checks in code as well to be more robust against someone forgetting such a flag.

[tkowalczyk]

Thank you @ethanfrey for clarification 👍