CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19830

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

Code injection

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The NETM function of a smart contract implementation for NewIntelTechMedia NETM, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Design/Logic Flaw

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Default credentials

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

CVE-2018-19833

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The CVE-2018-19833 entry concerns the DDQ smart contract (ERC20) where the function that sets/owners can be invoked by anyone because there is no caller identity check. Connected CNVD records (e.g., CNVD-2020-03511 describing DDQ override vulnerability) reiterate that the DDQ implementation’s own...

CVE-2018-19831

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19831

CVE-2018-19831 describes a permission issue in the Cryptbond Network (CBN) smart contract: the ToOwner() function does not validate the caller, enabling an attacker to modify the contract owner. Connected CNVD entries (CNVD-2020-43491 and CNVD-2020-43490) corroborate an authorization/overreach vu...

CVE-2018-19832

NETM (NewIntelTechMedia) smart contract contains an override vulnerability in the quaker function that fails to verify the caller’s identity, enabling an attacker to change the contract owner. Root cause: missing access control in quaker; impact: owner can be modified. No remediation or exploit d...

CVE-2018-19830

Summary: CVE-2018-19830 affects the BAFC smart contract on Ethereum (ERC20 token). The UBSexToken() function is publicly callable and does not verify the caller’s identity, enabling an attacker to change the contract owner. Connected CNVD entries confirm an overreach/owner modification vulnerabil...

CVE-2018-19830

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

CVE-2018-19834

The CVE-2018-19834 entry concerns a vulnerability in the smart contract quaker function that allows an attacker to change the contract owner due to lack of caller identity checks. Connected documents describe a recurring pattern across multiple ERC20-like contracts (e.g., BAFC, CBN, NETM, DDQ) wh...

CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

Hardcoded credentials

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

CVE-2018-18425

CVE-2018-18425 concerns Primeo (PEO), an Ethereum token. The doAirdrop function does not enforce a correct relation between the airdropped amount and the token’s total supply, allowing the contract owner to issue arbitrary currency. This bypasses the hard cap written in the contract and can deval...

CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...