Use unsigned-safe comparing in clamp contract