PT-2018-9809 · Beauty Ecosystem · Beauty Ecosystem Coin

Nugget_Alex · Published 2018-04-23 · Updated 2018-08-29 · CVE-2018-10299

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Beauty Ecosystem Coin (BEC) (affected versions not specified)

Description: The issue concerns an integer overflow in the batchTransfer function of a smart contract implementation. This allows attackers to increase digital assets without authorization by providing two receivers arguments along with a large value argument. The issue was exploited in the wild in April 2018.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2018-10299

Affected Products

Beauty Ecosystem Coin

References · 7

• 🔥 https://peckshield.com/2018/04/22/batchOverflow · Exploit
• 🔥 https://medium.com/secbit-media/a-disastrous-vulnerability-found-in-smart-contracts-of-beautychain-bec-dbf24ddbc30e · Exploit
• 🔥 https://dasp.co/#item-3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10299 · Security Note
• https://reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug · Note
• https://support.okex.com/hc/en-us/articles/360002944212-BeautyChain-BEC-Withdrawal-and-Trading-Suspended · Note
• https://twitter.com/OKEx_/status/987967343983714304 · Note