Aurora IDEX Membership(IDXM), ERC20 Token, allows attackers to acquire contract ownership (CVE-2018–10666)

Abstract I found a new vulnerability in smart contract of IDXM Token CVE-2018–106661. Attackers can acquire contract ownership because the setOwner function is delcared as public. A new owner can subsequently bypass intended access restrictions by, for example, calling uploadBalances. Details In...

Code injection

The Owned smart contract implementation for Aurora IDEX Membership IDXM, an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. A new owner can subsequently modify variables...

CVE-2018-10666

CVE-2018-10666 concerns the Owned smart contract implementation of Aurora IDEX Membership (IDXM). The vulnerability arises because setOwner is public, enabling an attacker to become contract owner. A new owner can then invoke functions protected by onlyOwner, potentially altering important variab...