Design/Logic Flaw

The approveAndCallcode function of a smart contract implementation for Block 18 18T, an tradable Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the "evilReflex"...

CVE-2018-12703

The CVE-2018-12703 vulnerability affects the approveAndCallcode flow in Block 18 (18T) ERC20 contracts. The issue is that _spender.call(_extraData) is not verified, enabling an attacker to hijack the callback and trigger arbitrary contract calls from the vulnerable contract. According to the Seeb...

CVE-2018-12703

The approveAndCallcode function of a smart contract implementation for Block 18 18T, an tradable Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the "evilReflex"...