4516 matches found
CVE-2018-17968
CVE-2018-17968 concerns a gambling smart contract for RuletkaIo on Ethereum. The vulnerability arises from a flawed random() function that relies on block timestamp and block hash, enabling an external contract to predict the generated random value. The description notes that an attacker could re...
PolyAI Integer Overflow Vulnerability
PolyAI AI is an ethereum-based virtual currency. The 'mintToken' function in PolyAI's smart contract implementation suffers from an integer overflow vulnerability that can be exploited by an attacker to set the balance of any user to any value...
CVE-2018-12975
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
Design/Logic Flaw
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
CVE-2018-12975
The random function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable which can be read with a getStorageAt call. Therefore, attackers can...
CVE-2018-12975
CVE-2018-12975 concerns CryptoSaga’s smart contract random() function. The vulnerability stems from using publicly readable variables—timestamp, current blockhash—and a private variable readable via getStorageAt—as inputs to random value creation. This allows an attacker to precompute the random ...
CVE-2018-17050
The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...
Integer overflow
The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...
CVE-2018-12511
In the mintToken function of a smart contract implementation for Substratum SUB, an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily...
CVE-2018-12511
The CVE-2018-12511 entry concerns Substratum (SUB) ERC-20 smart contracts. The vulnerability is in the mintToken function, where an administrator can control mintedAmount, exploit an integer overflow, and arbitrarily modify a user’s balance. This implies a privileged deniation of minting and pote...
CVE-2018-17050
The CVE-2018-17050 entry concerns PolyAi (AI) Ethereum token: the mintToken function in PolyAI’s smart contract has an integer overflow vulnerability that enables the contract owner to set any user’s balance to an arbitrary value. Affected component: mintToken in the PolyAI smart contract. Report...
CVE-2018-17071
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
Design/Logic Flaw
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
CVE-2018-17071
The CVE (CVE-2018-17071) concerns the fallback function of a simple lottery smart contract used in Lucky9io, an Ethereum gambling game. The vulnerability arises because the contract generates a random value using the publicly readable storage variable entry_number, which is privately defined but ...
CVE-2018-17071
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...
CVE-2018-17111
The CVE-2018-17111 entry concerns Coinlancer (CL) Ethereum ERC20 contract where the onlyOwner modifier has an incorrect comparison between msg.sender and owner, making functions protected by onlyOwner accessible to all contract users. Documents consistently cite this as an access-control vulnerab...
Block Overflow
github.com/ethereum/go-ethereum is vulnerable to block overflow. The library does not ensure that the end chain comes after the start chain in debug mode, causing an overwrite when processing a malformed block that can overwrite the next block in the sequence...
Design/Logic Flaw
In Go Ethereum aka geth before 1.8.14, TraceChain in eth/apitracer.go does not verify that the end block is after the start block...
