CVE-2018-12454

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.

La función _addguess de una implementación de contrato inteligente de simplelottery para 1000 Guess, un juego de apuestas de Ethereum, genera un valor aleatorio con variables leíbles globalmente como la información de bloque actual y una variable privada (que se puede leer con una llamada getStorageAt). Por lo tanto, permite que los atacantes ganen siempre y obtengan recompensas.