why use asserts in SafeMath to take all the gas?

[rstormsf]

require would safe some gas instead of eating it all up with assert

https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/math/SafeMath.sol#L14
https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/math/SafeMath.sol#L26
https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/math/SafeMath.sol#L32

[shrugs]

assert is more of an invariant label; during runtime, execution should never reach the point where an assert fails. At the moment, this is more of a "recommendation", but in the future it will ideally be fully verifiable.

Assuming that overflows aren't a desirable feature, any time that your int overflows, you can assume that something has gone very wrong (possibly via some sort of malformed/malicious input), so bailing hard and consuming all gas is pretty reasonable.

So I suppose the advice would be to write your contract such that those asserts are never reached, which means using require to screen the input to your calculations. Basically, normal uses of your contract should never hit assert and won't be bitten by the gas consumption.

---

that said, I totally see why it would be nice to use require, just from a "good citizen" perspective; it might be worth a separate SafeMath library that uses require, but changing the currently used one is probably not reasonable or doable.

[frangio]

The rationale was exactly what @shrugs said, and I'd like to highlight the spot on recommendation:

Write your contract such that those asserts are never reached

Here's a good article explaining all of the differences between assert and require: https://media.consensys.net/when-to-use-revert-assert-and-require-in-solidity-61fb2c0e5a57.

[rstormsf]

Completely disagree here, because safeMath is used widely in some constant functions which are used in some state changing functions which can result in losing all gas not because someone is trying to game the system because of the unpredictability of the state in a contract.

Yes, I think it's better to be a good citizen then a bully to take all up the gas. IMHO, no reason to reward miners for user's errors.
@frangio @shrugs

[frangio]

I think I see your point @rstormsf. I appreciate the discussion.

Can you give some examples of those constant functions? And how it can result in losing all gas.

[rstormsf]

My apologies, I was thinking about something else.
You are 100% right about it. I'm sorry.
@frangio