CVE-2018-17877 Business logic in n/a
Attackers can predict random values in the Greedy 599 gambling contract to always win rewards, bypassing anti-contract checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17877?
CVE-2018-17877 is a high-severity vulnerability in n/a, published on 23 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.
Weakness: CWE-338
Which versions are affected by CVE-2018-17877?
It affects 1 product.
Products include Greedy599 Greedy 599.
How do I fix CVE-2018-17877?
No fix has been published for CVE-2018-17877 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-17877 being exploited?
There is no known exploitation of CVE-2018-17877 in the wild and no public exploit code.
Sources
Also known as GHSA-qp5m-38pc-fmj4.