PT-2022-25527 · Profanity · Profanity

K06A · Published 2022-09-18 · Updated 2026-04-04 · CVE-2022-40769

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions profanity versions 1.60 and earlier

Description The issue allows attackers to recover private keys from Ethereum vanity addresses and steal cryptocurrency due to only four billion possible RNG initializations. This has been exploited in the wild, with incidents reported in June 2022.

Recommendations For versions 1.60 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2022-40769

Affected Products

Profanity

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-40769 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40769 · Vendor Advisory
• https://github.com/johguse/profanity · Note
• https://github.com/johguse/profanity/issues/61 · Note
• https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c · Note
• https://t.me/cvenotify/36413 · Telegram Post
• https://twitter.com/grok/status/2040497958639075802 · Twitter Post
• https://t.me/cibsecurity/50022 · Telegram Post