CVE-2018-12885 — MEDIUM (5.9)

Vulnerability Description

The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a private variable, (which can be read with a getStorageAt call). Therefore, attackers can get powerful champs/items and get rewards.

CVSS Score

5.9

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Mycryptochamp	Mycryptochamp	-

Related Weaknesses (CWE)

CWE-338

References

https://etherscan.io/address/0x689FB61845488297dfE7586E5f7956475955d2DcThird Party Advisory
https://etherscan.io/address/0xa44e464b13280340904ffef0a65b8a0033460430Third Party Advisory
https://medium.com/coinmonks/get-legendary-items-by-breaking-pnrg-of-mycyptochamExploitThird Party Advisory
https://etherscan.io/address/0x689FB61845488297dfE7586E5f7956475955d2DcThird Party Advisory
https://etherscan.io/address/0xa44e464b13280340904ffef0a65b8a0033460430Third Party Advisory
https://medium.com/coinmonks/get-legendary-items-by-breaking-pnrg-of-mycyptochamExploitThird Party Advisory

FAQ

What is CVE-2018-12885?

CVE-2018-12885 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a p...

How severe is CVE-2018-12885?

CVE-2018-12885 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-12885?

Check the references section above for vendor advisories and patch information. Affected products include: Mycryptochamp Mycryptochamp.