CoreCVE
Back

HIGH

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function)

Published Sep 7, 2018

Description

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-338

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 7, 2018
Updated Aug 5, 2024
Reserved Aug 19, 2018
Link CVE-2018-15552
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-15552
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-15552