5847 matches found
New batchOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018–10299)
Built on our earlier efforts in analyzing EOS tokens, we have developed an automated system to scan and analyze Ethereum-based ERC-20 token transfers. Specifically, our system will automatically send out alerts if any suspicious transactions e.g., involving unreasonably large tokens occur. In...
New proxyOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018-10376)
On 4/24/2018, 01:17:50 p.m. UTC, PeckShield again detected an unusual MESH token transaction shown in Figure 1. In this particular transaction, someone transferred a large amount of MESH token — 0x8fff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff 63 f’s to herself...
Beauty Ecosystem Coin smart contract integer overflow vulnerability
Beauty Ecosystem Coin BEC is a virtual currency system based on blockchain technology by the Beauty Chain Foundation. smart contract is one of the smart contracts. An integer overflow vulnerability exists in the 'batchTransfer' function of the smart contract implementation in BEC. An attacker cou...
CVE-2018-10299
An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers arguments in...
CVE-2018-10299
The Beauty Ecosystem Coin (BEC) , an Ethereum ERC20 token, is vulnerable to an integer overflow in its batchTransfer function, known as the "batchOverflow" issue. An attacker can provide two _receivers arguments along with an extremely large _value argument to cause the calculated amount to overf...
CVE-2018-10299
An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers arguments in...
VulnCheck KEV: CVE-2018-10299
An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers arguments in...
Coinbase: ETH contract handling errors
A business logic error in the ETH contract handling code allowed for a nested revert call in contract execution to improperly credit a user account though funds had not been transferred. In addition, the code did not appropriately handle delegatecall within a contract. Sample contract for the fir...
Out-of-bounds
An exploitable information leak/denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can...
CVE-2017-14457
An exploitable information leak/denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can...
CVE-2017-14457
The CVE-2017-14457 issue impacts CPP-Ethereum’s libevm create2 opcode handler. A crafted contract can set an extremely large initSize passed to the bytesConstRef used to compute the create2 hash, enabling an out-of-bounds read that can cause memory disclosure or a denial of service. Talos and CVE...
CVE-2017-14457
An exploitable information leak/denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can...
PT-2018-5654 · Ethereum · Cpp-Ethereum
Name of the Vulnerable Software and Affected Versions: CPP-Ethereum affected versions not specified Description: An exploitable information leak/denial of service issue exists in the libevm Ethereum Virtual Machine create2 opcode handler. A specially crafted smart contract code can cause an...
CPP-Ethereum libevm create2 Information Leak Vulnerability(CVE-2017-14457)
Summary An exploitable information leak / denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker ca...
CPP-Ethereum libevm pow2N Code Execution Vulnerability
Summary An exploitable out-of-bounds read vulnerability exists in libevm Ethereum Virtual Machine of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can...
CPP-Ethereum libevm create2 Information Leak Vulnerability
Summary An exploitable information leak / denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker ca...
Coinbase: Ethereum account balance manipulation
The researchers noticed an issue with our ETH receiving code when receiving from a contract. This allowed sending of ETH to Coinbase to be credited even if the underlying contract execution failed. The issue was fixed by changing the contract handling logic. Analysis of the issue indicated only...
jobashore.com XSS vulnerability
Open Bug Bounty ID: OBB-410525 Description| Value ---|--- Affected Website:| jobashore.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Hundreds of Millions in Digital Currency Remains Frozen
Between $150 million and $300 million in digital currency called ether remains inaccessible today after a user said he “accidentally” triggered a vulnerability that froze the funds in the popular Parity wallet. Parity Technologies issued an advisory warning users about the flaw in the Parity Wall...