PT-2018-12682 · Ethereum · Cryptogs

Publicado 2018-08-03 · Atualizado 2018-10-02 · CVE-2018-14715

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cryptogs (affected versions not specified)

Description The issue concerns the generation of random numbers in the smart contract implementations for Cryptogs, an Ethereum game. Specifically, the endCoinFlip function and throwSlammer function use an old block's hash to generate random numbers. This predictability allows attackers to always win the game by guessing the random number.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2018-14715

Produtos afetados

Cryptogs

Referências · 4

• 🔥 https://medium.com/coinmonks/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Exploit
• 🔥 https://medium.com/@jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Exploit
• https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14715 · Nota de Segurança