Vulnerability-Lookup

GHSA-7QVR-F99M-RPCH

Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:00

Details

The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-18425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-330"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-19T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token\u0027s total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using \u0027doAirdrop\u0027 ignores the hard cap written in the contract and devalues the token.)",
  "id": "GHSA-7qvr-f99m-rpch",
  "modified": "2024-04-04T01:00:33Z",
  "published": "2022-05-24T16:48:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18425"
    },
    {
      "type": "WEB",
      "url": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code"
    },
    {
      "type": "WEB",
      "url": "https://www.jianshu.com/p/09f238e9e568"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2018-18425 (GCVE-0-2018-18425)

Vulnerability from cvelistv5 – Published: 2019-06-19 15:57 – Updated: 2024-08-05 11:08

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://etherscan.io/address/0x21a8a03b34e053f9b1…	x_refsource_MISC
https://www.jianshu.com/p/09f238e9e568	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:08:21.821Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jianshu.com/p/09f238e9e568"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token\u0027s total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using \u0027doAirdrop\u0027 ignores the hard cap written in the contract and devalues the token.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-19T15:57:30.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jianshu.com/p/09f238e9e568"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18425",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token\u0027s total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using \u0027doAirdrop\u0027 ignores the hard cap written in the contract and devalues the token.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code",
              "refsource": "MISC",
              "url": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code"
            },
            {
              "name": "https://www.jianshu.com/p/09f238e9e568",
              "refsource": "MISC",
              "url": "https://www.jianshu.com/p/09f238e9e568"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18425",
    "datePublished": "2019-06-19T15:57:30.000Z",
    "dateReserved": "2018-10-16T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:08:21.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-7QVR-F99M-RPCH

CVE-2018-18425 (GCVE-0-2018-18425)

Tags

Sightings

Nomenclature