CVE-2018-17877

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-23 · updated 2026-06-17
Weakness: CWE-338

Description

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.

Affected products

Greedy599 Greedy 599: all versions

References

https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17877
https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17877

Get alerted when CVE-2018-17877 or the next vulnerability affects your stack