EvilReflex

What's this? This is a simple test for evilReflex vulnerablility in smart constract. How to test? Step 1：compile evilReflex.sol Step 2：deploy HACKME eg: Account Address： 0x62ba0a06ffc1d0a706172e1ed755b9b91f53a617 balance: 10090000000000000000000000 Contract address：...

EUVD-2018-4655

Malware in sbrugna...

EUVD-2018-4656

Malware in sbrugna...

New evilReflex Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-12702, CVE-2018-12703)

Update: 2018-06-24 With swift, coordinated response from Huobi.pro, we appreciate the announcement 11 on suspending the deposits and withdrawals of affected tokens! Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow...

Design/Logic Flaw

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12702

The CVE-2018-12702 entry concerns Globalvillage ecosystem (GVE) ERC20 contracts where approveAndCallcode allows an attacker to hijack a callback via a non-verified _spender.call(_extraData), enabling token transfers from the vulnerable contract (evilReflex). Connected sources describe the mechani...

CVE-2018-12703

The CVE-2018-12703 vulnerability affects the approveAndCallcode flow in Block 18 (18T) ERC20 contracts. The issue is that _spender.call(_extraData) is not verified, enabling an attacker to hijack the callback and trigger arbitrary contract calls from the vulnerable contract. According to the Seeb...

CVE-2018-12702: Improper Input Validation

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

PT-2018-11341

Name of the Vulnerable Software and Affected Versions Globalvillage ecosystem GVE smart contract implementation affected versions not specified Description The issue concerns the approveAndCall function in the smart contract implementation, which allows attackers to steal assets by transferring t...

PT-2018-11342

Name of the Vulnerable Software and Affected Versions Block 18 18T smart contract implementation affected versions not specified Description The issue concerns the approveAndCall function in a smart contract implementation, which allows attackers to steal assets by transferring the contract's...

CVE-2018-12703: Improper Input Validation

The approveAndCallcode function of a smart contract implementation for Block 18 18T, an tradable Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the "evilReflex"...