PT-2018-10056 · Aurora · Aurora Dao

Published 2018-05-09 · Updated 2019-10-03 · CVE-2018-10705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Aurora DAO (AURA) (affected versions not specified)

Description The issue concerns the Owned smart contract implementation for Aurora DAO, an Ethereum ERC20 token. It allows attackers to acquire contract ownership due to the setOwner function being declared as public. This enables an attacker to conduct a lockBalances() denial of service attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2018-10705

Affected Products

Aurora Dao

References · 2

• 🔥 https://peckshield.com/2018/05/03/ownerAnyone · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10705 · Security Note