Can not detect Bec.sol int overflow

Describe the bug Try ./myth -x Bec.sol. But no excepted report given, the only thing is the bellow. I am not sure if I missed some options, can anyone help?

==== Exception state ====
Type: Informational
Contract: BecToken
Function name: **ambiguous** t
PC address: 5260
A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. This is acceptable in most situations. Note however that `assert()` should only be used to check invariants. Use `require()` for regular input checking. 
--------------------
In file: solidity_examples/BECToken.sol:28

assert(c >= a)

--------------------

[muellerberndt]

Hmm, we don’t do multi-transactional analysis yet (it’s being implemented in #355) so it shouldn’t matter.

[JoranHonig]

Update:

pragma solidity ^0.4.16;
/**
 * @title SafeMath
 * @dev Math operations with safety checks that throw on error
 */
library SafeMath {
  function sub(uint256 a, uint256 b) internal constant returns (uint256) {
    assert(b <= a);
    return a - b;
  }

  function add(uint256 a, uint256 b) internal constant returns (uint256) {
    uint256 c = a + b;
    assert(c >= a);
    return c;
  }
}
/**
 * @title Ownable
 * @dev The Ownable contract has an owner address, and provides basic authorization control
 * functions, this simplifies the implementation of "user permissions".
 */
contract Ownable {
  address public owner;


  event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);


  /**
   * @dev The Ownable constructor sets the original `owner` of the contract to the sender
   * account.
   */
  function Ownable() {
    owner = msg.sender;
  }


  /**
   * @dev Throws if called by any account other than the owner.
   */
  modifier onlyOwner() {
    require(msg.sender == owner);
    _;
  }


  /**
   * @dev Allows the current owner to transfer control of the contract to a newOwner.
   * @param newOwner The address to transfer ownership to.
   */
  function transferOwnership(address newOwner) onlyOwner public {
    require(newOwner != address(0));
    OwnershipTransferred(owner, newOwner);
    owner = newOwner;
  }
}


/**
 * @title Pausable
 * @dev Base contract which allows children to implement an emergency stop mechanism.
 */
contract Pausable is Ownable {
  event Pause();
  event Unpause();

  bool public paused = false;


  /**
   * @dev Modifier to make a function callable only when the contract is not paused.
   */
  modifier whenNotPaused() {
    require(!paused);
    _;
  }

  /**
   * @dev Modifier to make a function callable only when the contract is paused.
   */
  modifier whenPaused() {
    require(paused);
    _;
  }

  /**
   * @dev called by the owner to pause, triggers stopped state
   */
  function pause() whenNotPaused public {
    paused = true;
    Pause();
  }

  /**
   * @dev called by the owner to unpause, returns to normal state
   */
  function unpause() whenPaused public {
    paused = false;
    Unpause();
  }
}

contract IntegerOverflow2 is Pausable{
    using SafeMath for uint256;
    uint256 public count = 7;
    mapping(address => uint256) balances;


//     function run(uint256 input, uint256 _value, address[] _receivers) public whenNotPaused {
//         uint256 cnt = 2;
//
//         require(cnt > 0 && cnt <= 20);
//         require(_value > 0 && balances[msg.sender] >= _value);
//         balances[msg.sender] = balances[msg.sender].sub(_value);
//
//         for (uint i = 0; i < cnt; i++) {
//             balances[_receivers[i]] = balances[_receivers[i]].add(_value);
//         }
//
//         count *= input;
//    }
//
  function batchTransfer(address[] _receivers, uint256 _value) public {
    uint cnt = _receivers.length;
    uint256 amount = uint256(cnt) * _value;

    require(cnt > 0 && cnt <= 20);

    balances[msg.sender] -= amount;
  }

}
pragma solidity ^0.4.16;
/**
 * @title SafeMath
 * @dev Math operations with safety checks that throw on error
 */
library SafeMath {
  function sub(uint256 a, uint256 b) internal constant returns (uint256) {
    assert(b <= a);
    return a - b;
  }

  function add(uint256 a, uint256 b) internal constant returns (uint256) {
    uint256 c = a + b;
    assert(c >= a);
    return c;
  }
}
/**
 * @title Ownable
 * @dev The Ownable contract has an owner address, and provides basic authorization control
 * functions, this simplifies the implementation of "user permissions".
 */
contract Ownable {
  address public owner;


  event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);


  /**
   * @dev The Ownable constructor sets the original `owner` of the contract to the sender
   * account.
   */
  function Ownable() {
    owner = msg.sender;
  }


  /**
   * @dev Throws if called by any account other than the owner.
   */
  modifier onlyOwner() {
    require(msg.sender == owner);
    _;
  }


  /**
   * @dev Allows the current owner to transfer control of the contract to a newOwner.
   * @param newOwner The address to transfer ownership to.
   */
  function transferOwnership(address newOwner) onlyOwner public {
    require(newOwner != address(0));
    OwnershipTransferred(owner, newOwner);
    owner = newOwner;
  }
}


/**
 * @title Pausable
 * @dev Base contract which allows children to implement an emergency stop mechanism.
 */
contract Pausable is Ownable {
  event Pause();
  event Unpause();

  bool public paused = false;


  /**
   * @dev Modifier to make a function callable only when the contract is not paused.
   */
  modifier whenNotPaused() {
    require(!paused);
    _;
  }

  /**
   * @dev Modifier to make a function callable only when the contract is paused.
   */
  modifier whenPaused() {
    require(paused);
    _;
  }

  /**
   * @dev called by the owner to pause, triggers stopped state
   */
  function pause() whenNotPaused public {
    paused = true;
    Pause();
  }

  /**
   * @dev called by the owner to unpause, returns to normal state
   */
  function unpause() whenPaused public {
    paused = false;
    Unpause();
  }
}

contract IntegerOverflow2 is Pausable{
    using SafeMath for uint256;
    uint256 public count = 7;
    mapping(address => uint256) balances;


//     function run(uint256 input, uint256 _value, address[] _receivers) public whenNotPaused {
//         uint256 cnt = 2;
//
//         require(cnt > 0 && cnt <= 20);
//         require(_value > 0 && balances[msg.sender] >= _value);
//         balances[msg.sender] = balances[msg.sender].sub(_value);
//
//         for (uint i = 0; i < cnt; i++) {
//             balances[_receivers[i]] = balances[_receivers[i]].add(_value);
//         }
//
//         count *= input;
//    }
//
  function batchTransfer(address[] _receivers, uint256 _value) public {
    uint cnt = _receivers.length;
    uint256 amount = uint256(cnt) * _value;

    require(cnt > 0 && cnt <= 20);

    balances[msg.sender] -= amount;
  }

}

Minimal contract that cannot be solved with increased max-depth and solve timeout