PT-2018-12336 · Ethereum · Virgo Zodiactoken

Published 2018-07-16 · Updated 2018-09-12 · CVE-2018-14089

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Virgo ZodiacToken (affected versions not specified)

Description An issue was discovered in the smart contract implementation for Virgo ZodiacToken, an Ethereum token. The issue arises from the line bool sufficientAllowance = allowance <= value, where the use of <= instead of >= allows for an arbitrary transfer in the transferFrom function. This means an attacker can transfer funds from any address to their own address without needing to meet the allowance > value condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-14089

Affected Products

Virgo Zodiactoken

References · 2

• 🔥 https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14089 · Security Note