CVE-2018-12056

The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the _seed value can be retrieved with a getStorageAt call. Therefore, it allows attackers to always win and get rewards.

The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the _seed value can be retrieved with a getStorageAt call. Therefore, it allows attackers to always win and get rewards.

La función maxRandom de la implementación de contrato inteligente para All For One, un juego de apuestas de Ethereum, genera un valor aleatorio con variables legibles públicamente porque se puede recuperar el valor _seed con una llamada getStorageAt. Por lo tanto, permite que los atacantes siempre ganen y obtengan premios.