PT-2019-9590 · Primeo · Primeo

Published 2019-06-19 · Updated 2019-06-24 · CVE-2018-18425

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Primeo (PEO) smart contract implementation (affected versions not specified)

Description The issue concerns the doAirdrop function in the smart contract implementation, which fails to validate the numerical relationship between the airdrop amount and the token's total supply. This allows the contract owner to issue an arbitrary amount of currency, effectively increasing the total supply beyond the hard cap defined in the contract and devaluing the token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2018-18425

Affected Products

Primeo

References · 3

• 🔥 https://jianshu.com/p/09f238e9e568 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18425 · Security Note
• https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code · Note