Integer overflow and underflow defects

Cosmos Labs pushed a fund-loss fix through the channel it reserves for harmless bugs

GHSA-7g4w-cg88-2cq2 was reported on April 25, judged no threat to live funds, and quietly patched on August 19. Attackers drained six chains starting the next day, and the only real fix breaks state.