According to a recent post¹,

you can safely do arithmetic in pure bash (i.e., without /usr/bin/[). printf can parse a numeric literal without performing “Arithmetic Expansion” (ACE in a trenchcoat):

printf -v parsedNum “%d” “$untrustedInput”

That printf will return non-zero if it didn’t parse, but it will also set parsedNum to zero, so even if you don’t check for a return code parsedNum is safe to evaluate in Arithmetic Expansion, as far as we can tell