What is CVE-2018-17877?

CVE-2018-17877 is a high-severity vulnerability in Greedy599 Greedy 599, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 7.5/10. Published 2018-10-23.

How severe is CVE-2018-17877?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Greedy599 Greedy 599

CVE-2018-17877

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.

EPSS: 0.016 (73.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Greedy599 Greedy_599
N/a — versions n/a

Weakness classification (CWE)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-17877?: CVE-2018-17877 is a high-severity vulnerability in Greedy599 Greedy 599, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 7.5/10. Published 2018-10-23.
How severe is CVE-2018-17877?: High severity. CVSS v3 base score is 7.5 out of 10.