PT-2018-11185 · Ethereum · Simplelottery Smart Contract

Published 2018-06-17 · Updated 2018-08-14 · CVE-2018-12454

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions simplelottery smart contract implementation for 1000 Guess (affected versions not specified)

Description The issue concerns the addguess function of the simplelottery smart contract implementation, which is used in the 1000 Guess Ethereum gambling game. This function generates a random value using publicly readable variables, such as the current block information, and a private variable that can be accessed through a getStorageAt call. As a result, attackers can predict the outcome and always win, allowing them to claim rewards.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2018-12454

Affected Products

Simplelottery Smart Contract

References · 4

• 🔥 https://medium.com/coinmonks/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d · Exploit
• 🔥 https://medium.com/@jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12454 · Security Note
• https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d · Note