CVE-2018-12885

State: Published
Severity: Not scored
Published: Aug 7, 2018
Updated: Aug 5, 2024
Reserved: Jun 26, 2018

Description

The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a private variable, (which can be read with a getStorageAt call). Therefore, attackers can get powerful champs/items and get rewards.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://etherscan.io/address/0xa44e464b13280340904ffef0a65b8a0033460430
https://medium.com/coinmonks/get-legendary-items-by-breaking-pnrg-of-mycyptochamp-an-ethereum-online-game-cve-2018-12855-6e6beb41b8df
https://etherscan.io/address/0x689FB61845488297dfE7586E5f7956475955d2Dc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.