CVE-2018-12702: Improper Input Validation

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12081: Undefined Security Weakness

The mintToken function of a smart contract implementation for Target Coin TGT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12068: Integer Overflow or Wraparound

The sell function of a smart contract implementation for Target Coin TGT, a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka...

CVE-2018-12078: Undefined Security Weakness

The mintToken function of a smart contract implementation for PolyAI AI, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-11446: Integer Overflow or Wraparound

The buy function of a smart contract implementation for Gold Reward GRX, an Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the buyer because of overflow of the multiplication of its argument amount and a manipulable variable buyPrice, aka the...

CVE-2018-12067: Integer Overflow or Wraparound

The sell function of a smart contract implementation for Substratum SUB, a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka...

CVE-2018-12703: Improper Input Validation

The approveAndCallcode function of a smart contract implementation for Block 18 18T, an tradable Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the "evilReflex"...

CVE-2018-12082: Undefined Security Weakness

The mintToken function of a smart contract implementation for Fujinto NTO, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

Input validation

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The CVE-2018-12025 entry concerns FuturXE (FXE) ERC20 token. Connected sources provide concrete details: transferFrom is vulnerable due to a logic error in the allowance check—the condition if (allowed[from][msg.sender] >= value) return false misorders the logic, allowing an underflow on allow...

CVE-2018-12025: Improper Input Validation

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

New multiOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-10706)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow, proxyOverflow, transferFlaw, ownerAnyone. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to steal tokens from...

New allowAnyone Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11397, CVE-2018-11398)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5, burnOverflow6, ceoAnyone7. Some of them could be used by attackers to generate tokens out of nowhere ...

New burnOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11239)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to...

Design/Logic Flaw

The transferFrom function of a smart contract implementation for DimonCoin FUD, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer all victims' balances into their account because certain computations involving value are incorrect...

CVE-2018-11411

The transferFrom function of a smart contract implementation for DimonCoin FUD, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer all victims' balances into their account because certain computations involving value are incorrect...

CVE-2018-11411

The transferFrom function of a smart contract implementation for DimonCoin FUD, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer all victims' balances into their account because certain computations involving value are incorrect...