4437 matches found
CVE-2018-17968
A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. The developer wrote a random function that uses a block timestamp and block hash from the Ethereum blockchain. This can be predicted by...
CVE-2018-17877
CVE-2018-17877 concerns a lottery Smart Contract for Greedy 599 (Ethereum). The vulnerability: the contract generates a random value that is predictable through an external contract call. The developer attempted to prevent malicious contracts with extcodesize(), but an attacker can bypass this by...
PolyAI Integer Overflow Vulnerability
PolyAI AI is an ethereum-based virtual currency. The 'mintToken' function in PolyAI's smart contract implementation suffers from an integer overflow vulnerability that can be exploited by an attacker to set the balance of any user to any value...
Design/Logic Flaw
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
CVE-2018-12975
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
CVE-2018-12975
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
CVE-2018-12975
CVE-2018-12975 concerns CryptoSaga’s smart contract random() function. The vulnerability stems from using publicly readable variables—timestamp, current blockhash—and a private variable readable via getStorageAt—as inputs to random value creation. This allows an attacker to precompute the random ...
CVE-2018-17050
The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...
Integer overflow
The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...
CVE-2018-12511
In the mintToken function of a smart contract implementation for Substratum SUB, an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily...
CVE-2018-17050
The CVE-2018-17050 entry concerns PolyAi (AI) Ethereum token: the mintToken function in PolyAI’s smart contract has an integer overflow vulnerability that enables the contract owner to set any user’s balance to an arbitrary value. Affected component: mintToken in the PolyAI smart contract. Report...
CVE-2018-12511
The CVE-2018-12511 entry concerns Substratum (SUB) ERC-20 smart contracts. The vulnerability is in the mintToken function, where an administrator can control mintedAmount, exploit an integer overflow, and arbitrarily modify a user’s balance. This implies a privileged deniation of minting and pote...
CVE-2018-17071
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
Design/Logic Flaw
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
CVE-2018-17111
The CVE-2018-17111 entry concerns Coinlancer (CL) Ethereum ERC20 contract where the onlyOwner modifier has an incorrect comparison between msg.sender and owner, making functions protected by onlyOwner accessible to all contract users. Documents consistently cite this as an access-control vulnerab...
CVE-2018-17071
The CVE (CVE-2018-17071) concerns the fallback function of a simple lottery smart contract used in Lucky9io, an Ethereum gambling game. The vulnerability arises because the contract generates a random value using the publicly readable storage variable entry_number, which is privately defined but ...
CVE-2018-17071
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
Block Overflow
github.com/ethereum/go-ethereum is vulnerable to block overflow. The library does not ensure that the end chain comes after the start chain in debug mode, causing an overwrite when processing a malformed block that can overwrite the next block in the sequence...