Exploitable Random Number Generation in SimpleLottery Smart Contract Allows Guaranteed Wins

CVE-2018-12454 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.

Learn more about our Web Application Penetration Testing UK.