CVE-2018-18425
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an…
Does this matter?
Lower severity and a low EPSS score (1.06%). Track it; it rarely justifies an emergency change on its own.
Description
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.06% probability · 65th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- primeo project/primeo
- Source
- cve@mitre.org
EPSS 1.1% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.