PT-2018-12682 · Ethereum · Cryptogs

Published 2018-08-03 · Updated 2018-10-02 · CVE-2018-14715

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cryptogs (affected versions not specified)

Description The issue concerns the generation of random numbers in the smart contract implementations for Cryptogs, an Ethereum game. Specifically, the endCoinFlip function and throwSlammer function use an old block's hash to generate random numbers. This predictability allows attackers to always win the game by guessing the random number.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2018-14715

Affected Products

Cryptogs

References · 4

• 🔥 https://medium.com/coinmonks/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Exploit
• 🔥 https://medium.com/@jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14715 · Security Note
• https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-cryptogs-an-ethereum-cve-2018-14715-f63a51ac2eb9 · Note