PT-2018-10094 · Smartmesh+4 · Smartmesh+4

Published 2018-08-10 · Updated 2019-10-03 · CVE-2018-10769

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SmartMesh (SMT) (affected versions not specified) First (FST) (affected versions not specified) GG Token (GG) (affected versions not specified) M2C Mesh Network (MTC) (affected versions not specified) M2C Mesh Network (mesh) (affected versions not specified) UG Token (UGT) (affected versions not specified)

Description The issue concerns the transferProxy and approveProxy functions in a smart contract implementation, which can be exploited for unauthorized transfer of digital assets due to replay attacks. This can occur when the same-named functions with the same signatures are used in other tokens.

Recommendations For SmartMesh (SMT), consider disabling the transferProxy and approveProxy functions until a patch is available. For First (FST), restrict access to the transferProxy and approveProxy functions to minimize the risk of exploitation. For GG Token (GG), avoid using the transferProxy and approveProxy functions in conjunction with other tokens until the issue is resolved. For M2C Mesh Network (MTC) and M2C Mesh Network (mesh), temporarily disable the transferProxy and approveProxy functions to prevent unauthorized transfers. For UG Token (UGT), restrict the use of the transferProxy and approveProxy functions to trusted sources only.

Exploit

Fix

Related Identifiers

CVE-2018-10769

Affected Products

First

Gg Token

M2C Mesh Network

Smartmesh

Ug Token

References · 3

• 🔥 https://github.com/nkbai/defcon26/blob/master/docs/Replay%20Attacks%20on%20Ethereum%20Smart%20Contracts.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10769 · Security Note
• https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E · Note