CVE-2018-19833

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The CVE-2018-19833 entry concerns the DDQ smart contract (ERC20) where the function that sets/owners can be invoked by anyone because there is no caller identity check. Connected CNVD records (e.g., CNVD-2020-03511 describing DDQ override vulnerability) reiterate that the DDQ implementation’s own...

CVE-2018-19831

CVE-2018-19831 describes a permission issue in the Cryptbond Network (CBN) smart contract: the ToOwner() function does not validate the caller, enabling an attacker to modify the contract owner. Connected CNVD entries (CNVD-2020-43491 and CNVD-2020-43490) corroborate an authorization/overreach vu...

CVE-2018-19831

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19832

NETM (NewIntelTechMedia) smart contract contains an override vulnerability in the quaker function that fails to verify the caller’s identity, enabling an attacker to change the contract owner. Root cause: missing access control in quaker; impact: owner can be modified. No remediation or exploit d...

CVE-2018-19832

The NETM function of a smart contract implementation for NewIntelTechMedia NETM, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19830

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

CVE-2018-19830

Summary: CVE-2018-19830 affects the BAFC smart contract on Ethereum (ERC20 token). The UBSexToken() function is publicly callable and does not verify the caller’s identity, enabling an attacker to change the contract owner. Connected CNVD entries confirm an overreach/owner modification vulnerabil...

CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19834

The CVE-2018-19834 entry concerns a vulnerability in the smart contract quaker function that allows an attacker to change the contract owner due to lack of caller identity checks. Connected documents describe a recurring pattern across multiple ERC20-like contracts (e.g., BAFC, CBN, NETM, DDQ) wh...

PT-2019-9930

Name of the Vulnerable Software and Affected Versions DDQ smart contract implementation affected versions not specified Description The issue concerns a smart contract implementation for DDQ, an Ethereum ERC20 token. It allows attackers to change the owner of the contract because the owned functi...

PT-2019-9931

Name of the Vulnerable Software and Affected Versions BOMBBA BOMB smart contract implementation affected versions not specified Description The issue concerns a smart contract implementation for BOMBBA, an Ethereum ERC20 token. It allows attackers to change the owner of the contract due to the...

CVE-2018-19833: Improper Authentication

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

PT-2019-9928

Name of the Vulnerable Software and Affected Versions Cryptbond Network CBN affected versions not specified Description The issue concerns the ToOwner function of a smart contract implementation for Cryptbond Network CBN, which is an tradable Ethereum ERC20 token. This function allows attackers t...

PT-2019-9929

Name of the Vulnerable Software and Affected Versions NewIntelTechMedia NETM affected versions not specified Description The issue concerns the NETM function in a smart contract implementation for NewIntelTechMedia NETM, an Ethereum ERC20 token. This function does not properly check the caller's...

Slither v0.6.7 - Static Analyzer For Solidity

Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code...

I'm Looking to Hire a Strategist to Help Figure Out Public-Interest Tech

I am in search of a strategic thought partner: a person who can work closely with me over the next 9 to 12 months in assessing what's needed to advance the practice, integration, and adoption of public-interest technology. All of the details are in the RFP. The selected strategist will work close...

BlockDev Sp. Z o.o: Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`

Summary: The flap contract provides the ability to auction DAI for MKR. That's a fundamental functionality of the MCD system, invoked usually from the vow contract. A flaw in the validation of calls to flap.kick, however, allows a malicious user to create "fake' auctions that can be later used to...

BlockDev Sp. Z o.o: Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`

Summary: The flip contract allows for the MCD system to auction collateral in exchange for DAI. A lack of validation in the method flip.kick allows an attacker to create an auction with a fake bid value. Since the end contract trusts that value, it can be exploited to issue any amount of free DAI...

IBM Emptoris Contract Management Information Disclosure Vulnerability (CNVD-2019-31129)

IBM Emptoris Contract Management is a suite of software from IBM USA that automates the contract lifecycle. The software automates and manages all phases of the contract lifecycle, from the creation, execution and renegotiation of contracts and amendments, to performance monitoring, analysis and...