CVE-2018-12454 - The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call)

Back Back to CVE browser

HIGH

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call)

Published Jun 17, 2018

7.5

HIGH

CVSS 3.0

EPSS 1.25%

Description

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-338

References (1)

https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d
x_refsource_MISC

Link	Providers	Tags
https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d		x_refsource_MISC

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 17, 2018

Updated Aug 5, 2024

Reserved Jun 15, 2018

Link CVE-2018-12454

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-12454

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-12454