CVE-2018-18425 - The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency

Back Back to CVE browser

MEDIUM

The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency

Published Jun 19, 2019

6.5

MEDIUM

CVSS 3.0

EPSS 1.08%

Description

The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-330

Insufficient Randomness

References (3)

https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10153
Advisory
https://www.jianshu.com/p/09f238e9e568
x_refsource_MISCExploitPatchThird Party Advisory

Link	Providers	Tags
https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10153		Advisory
https://www.jianshu.com/p/09f238e9e568		x_refsource_MISCExploitPatchThird Party Advisory