Team Code4Block

6 exploits Active since Sep 2018
CVE-2018-15552 WRITEUP HIGH WRITEUP
The Ethereum Lottery - Predictable Random Number Generation in PayWinner Function
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.
CVSS 7.5
CVE-2018-17071 WRITEUP HIGH WRITEUP
Lucky9io - Predictable Random Number Generation via Public Storage Variable
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entry_number. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a ticket at a low price by directly calling the fallback function with small msg.value, because the developer set the currency unit incorrectly. Therefore, it allows attackers to always win and get rewards.
CVSS 7.5
CVE-2018-17111 WRITEUP CRITICAL WRITEUP
Coinlancer CL - Privilege Escalation
The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential access control vulnerability. All contract users can access functions that use this onlyOwner modifier, because the comparison between msg.sender and owner is incorrect.
CVSS 9.8
CVE-2018-17877 WRITEUP HIGH WRITEUP
Greedy 599 - Predictable Random Value Generation via External Contract Call
A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.
CVSS 7.5
CVE-2018-17968 WRITEUP HIGH WRITEUP
RuletkaIo - Predictable Random Value Generation via Blockchain Timestamp and Hash
A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. The developer wrote a random() function that uses a block timestamp and block hash from the Ethereum blockchain. This can be predicted by writing the same random function code in an exploit contract to determine the deadSeat value.
CVSS 7.5
CVE-2018-17987 WRITEUP HIGH WRITEUP
HashHeroes - Use of Insufficiently Random Values in determineWinner Function
The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUM_TILES equals the number of people who purchased a tile, which allows an attacker to control the awarding of the prize by being the last person to purchase a tile.
CVSS 7.5