CVE-2018-10468

Published: Apr 28, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all victims' balances into their account) because certain computations involving _value are incorrect, as exploited in the wild starting in December 2017, aka the "transferFlaw" issue.

Affected (1)

Products: Uetoken: Useless Ethereum Token

1 product

Useless Ethereum Token

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Uetoken Useless Ethereum Token	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://medium.com/%40jonghyk.song/uselessethereumtoken-uet-erc20-token-allows-attackers-to-steal-all-victims-balances-543d42ac808e

Source: cve@mitre.org

https://peckshield.com/2018/04/28/transferFlaw/

Source: cve@mitre.org

ExploitThird Party Advisory

https://medium.com/%40jonghyk.song/uselessethereumtoken-uet-erc20-token-allows-attackers-to-steal-all-victims-balances-543d42ac808e

Source: af854a3a-2127-422b-91ae-364da2661108

https://peckshield.com/2018/04/28/transferFlaw/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.