CVE-2018-18425
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an…
Does this matter?
Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.
Description
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- primeo project/primeo
- Source
- cve@mitre.org
References
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.