PT-2018-9371 · Soar Coin · Soar Coin

Published 2018-06-06 · Updated 2019-10-03 · CVE-2018-1000203

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Soar Coin versions up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f

Description The issue concerns an intentional backdoor in the zero fee transaction() function, which can lead to the theft of Soar Coins by the central account after a payment is processed.

Recommendations For Soar Coin versions up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f, as a temporary workaround, consider disabling the zero fee transaction() function until a patch is available.

Fix

Related Identifiers

CVE-2018-1000203

Affected Products

Soar Coin

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000203 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000203 · Vendor Advisory
• https://raw.githubusercontent.com/neowenyuan27/SoarCoin/master/wallet/soarcoinv2.sol · Note
• https://bankinfosecurity.com/exclusive-aussie-firm-loses-5m-to-backdoored-cryptocurrency-a-11057 · Note