CVE-2018-15552

Published: Sep 7, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.

Affected (1)

Products: Theethereumlottery: The Ethereum Lottery

Theethereumlottery

1 product

The Ethereum Lottery

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Theethereumlottery The Ethereum Lottery	All versions

Related CWEs

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (2)

https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.