PT-2018-14305 · Ethereum · Ruletkaio

Published 2018-10-23 · Updated 2018-12-08 · CVE-2018-17968

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RuletkaIo (affected versions not specified)

Description The issue concerns a predictable random value generation in a smart contract implementation for an Ethereum gambling game. Specifically, the random() function uses a block timestamp and block hash from the Ethereum blockchain, making it predictable. An external contract can exploit this by replicating the random() function to determine the deadSeat value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2018-17968

Affected Products

Ruletkaio

References · 2

• 🔥 https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17968 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17968 · Security Note