CVE-2018-18425

MEDIUM

Primeo - Arbitrary Token Minting via doAirdrop Function

Title source: llm
STIX 2.1

Description

The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)

References (2)

Core 2
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://www.jianshu.com/p/09f238e9e568

Scores

CVSS v3 6.5
EPSS 0.0109
EPSS Percentile 60.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-330
Status published
Products (1)
primeo_project/primeo
Published Jun 19, 2019
Tracked Since Feb 18, 2026