CVE-2018-12975 | BDVDB-2026-107331 Detail

Description#

The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable (which can be read with a getStorageAt call). Therefore, attackers can precompute the random number and manipulate the game (e.g., get powerful characters or get critical damages).

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://medium.com/%40jonghyk.song/create-legendary-champs-by-breaking-prng-of-cryptosaga-an-ethereum-rpg-game-cve-2018-12975-8de733ff8255

Exploit#

No public exploit known

History#

Version 12018-09-24Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.