1. Home
  2. CVE Database
  3. CVE-2018-15552
HIGH · 7.5

CVE-2018-15552

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (wh...

Vulnerability Description

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
TheethereumlotteryThe Ethereum Lottery-

Related Weaknesses (CWE)

CWE-338

References

FAQ

What is CVE-2018-15552?

CVE-2018-15552 is a vulnerability with a CVSS score of 7.5 (HIGH). The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (wh...

How severe is CVE-2018-15552?

CVE-2018-15552 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-15552?

Check the references section above for vendor advisories and patch information. Affected products include: Theethereumlottery The Ethereum Lottery.