CVE-2018-12702

HIGH

Globalvillage ecosystem (GVE) - Unverified Callcode Execution in approveAndCallcode Function

Title source: llm

Description

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer the contract's balances into their account) because the callcode (i.e., _spender.call(_extraData)) is not verified, aka the "evilReflex" issue. NOTE: a PeckShield disclosure states "some researchers have independently discussed the mechanism of such vulnerability."

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://huobiglobal.zendesk.com/hc/en-us/articles/360000110521-HADAX-Suspends-18T-and-GVE-Deposits-and-Withdrawals

Exploit, Third Party Advisory x_refsource_misc

https://peckshield.com/2018/06/23/evilReflex/

Scores

CVSS v3 7.5

EPSS 0.0109

EPSS Percentile 61.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-20

Status published

Products (1)

gve/globalvillage_ecosystem

Published Jun 25, 2018

Tracked Since Feb 18, 2026