CVE-2018-10376

Опубликовано: 25 апр. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the "proxyOverflow" issue.

Ссылки

https://dasp.co/#item-3
Not Applicable
https://peckshield.com/2018/04/25/proxyOverflow/
Exploit
Third Party Advisory
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/
Exploit
Third Party Advisory
https://dasp.co/#item-3
Not Applicable
https://peckshield.com/2018/04/25/proxyOverflow/
Exploit
Third Party Advisory
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:smartmesh:smartmesh:-:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00267

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

GHSA-65c2-c54h-rp7q