CVE-2018-17050

The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-12511

In the mintToken function of a smart contract implementation for Substratum SUB, an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily...

Integer overflow

The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

Integer overflow

In the mintToken function of a smart contract implementation for Substratum SUB, an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily...

CVE-2018-12511

In the mintToken function of a smart contract implementation for Substratum SUB, an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily...

CVE-2018-12511

The CVE-2018-12511 entry concerns Substratum (SUB) ERC-20 smart contracts. The vulnerability is in the mintToken function, where an administrator can control mintedAmount, exploit an integer overflow, and arbitrarily modify a user’s balance. This implies a privileged deniation of minting and pote...

CVE-2018-17050

The mintToken function of a smart contract implementation for PolyAi AI, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-17050

The CVE-2018-17050 entry concerns PolyAi (AI) Ethereum token: the mintToken function in PolyAI’s smart contract has an integer overflow vulnerability that enables the contract owner to set any user’s balance to an arbitrary value. Affected component: mintToken in the PolyAI smart contract. Report...

CVE-2018-17071

The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...

Design/Logic Flaw

The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...

CVE-2018-17071

The CVE (CVE-2018-17071) concerns the fallback function of a simple lottery smart contract used in Lucky9io, an Ethereum gambling game. The vulnerability arises because the contract generates a random value using the publicly readable storage variable entry_number, which is privately defined but ...

CVE-2018-17071

The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entrynumber. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a tick...

CVE-2018-17111

The CVE-2018-17111 entry concerns Coinlancer (CL) Ethereum ERC20 contract where the onlyOwner modifier has an incorrect comparison between msg.sender and owner, making functions protected by onlyOwner accessible to all contract users. Documents consistently cite this as an access-control vulnerab...

CVE-2018-17111

The onlyOwner modifier of a smart contract implementation for Coinlancer CL, an Ethereum ERC20 token, has a potential access control vulnerability. All contract users can access functions that use this onlyOwner modifier, because the comparison between msg.sender and owner is incorrect...

CVE-2018-15552

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" which is private, yet predictable and readable by the eth.getStorageAt function. Therefore, it allow...

CVE-2018-15552

The CVE describes a vulnerability in the PayWinner function of a simplelottery smart contract used by The Ethereum Lottery. The root cause is that the function uses the publicly readable storage variable maxTickets (private in code) to generate a random value, which is readable via eth.getStorage...

CVE-2018-15552

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" which is private, yet predictable and readable by the eth.getStorageAt function. Therefore, it allow...

All For One Information Disclosure Vulnerability

All For One is an Ether-based gambling game. An information disclosure vulnerability exists in the 'maxRandom' function in All For One's smart contract implementation, which stems from the program's use of publicly readable variables to generate arbitrary values. An attacker could use the...

Bitcoin Red Integer Overflow Vulnerability

Bitcoin Red BTCR is an Ether-based digital currency. An integer overflow vulnerability exists in the 'distributeBTR' function in BTCR's smart contract implementation. An attacker can exploit the vulnerability to increase the balance of their own account...

Design/Logic Flaw

The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the seed value can be retrieved with a getStorageAt call. Therefore, it allows attackers to always win and get rewards...