CVE-2018-10299

An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two _receivers arguments in conjunction with a large _value argument, as exploited in the wild in April 2018, aka the "batchOverflow" issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
VendorProductVersion
beautybeauty_ecosystem_coin
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://dasp.co/#item-3
https://medium.com/secbit-media/a-disastrous-vulnerability-found-in-smart-contracts-of-beautychain-bec-dbf24ddbc30e
https://peckshield.com/2018/04/22/batchOverflow/
https://support.okex.com/hc/en-us/articles/360002944212-BeautyChain-BEC-Withdrawal-and-Trading-Suspended
https://twitter.com/OKEx_/status/987967343983714304
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/
https://dasp.co/#item-3
https://medium.com/secbit-media/a-disastrous-vulnerability-found-in-smart-contracts-of-beautychain-bec-dbf24ddbc30e
https://peckshield.com/2018/04/22/batchOverflow/
https://support.okex.com/hc/en-us/articles/360002944212-BeautyChain-BEC-Withdrawal-and-Trading-Suspended
https://twitter.com/OKEx_/status/987967343983714304
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/