CVE-2018-14089

Published: Jul 16, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <= _value' will cause an arbitrary transfer in the function transferFrom because '<=' is used instead of '>=' (which was intended). An attacker can transfer from any address to his address, and does not need to meet the 'allowance > value' condition.

Affected (1)

Products: Virgo Zodiactoken Project: Virgo Zodiactoken

Virgo Zodiactoken Project

1 product

Virgo Zodiactoken

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Virgo Zodiactoken Project Virgo Zodiactoken	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.