Back to KEVs

CVE-2018-10299

An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 token used...

Basic Information

CVE State: PUBLISHED
Reserved Date: April 22, 2018
Published Date: April 23, 2018
Last Updated: August 05, 2024
Vendor: Beauty Chain
Product: Beauty Ecosystem Coin (BEC)
Description: An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two _receivers arguments in conjunction with a large _value argument, as exploited in the wild in April 2018, aka the "batchOverflow" issue.

CVSS Scores

CVSS v3.0

7.5 - HIGH

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

5.0

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploit Status

Exploited in the Wild: Yes (2018-04-23 04:00:00 UTC) Source

References

https://medium.com/secbit-media/a-disastrous-vulnerability-found-in-smart-contracts-of-beautychain-bec-dbf24ddbc30e https://twitter.com/OKEx_/status/987967343983714304 https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/ https://dasp.co/#item-3 https://peckshield.com/2018/04/22/batchOverflow/ https://support.okex.com/hc/en-us/articles/360002944212-BeautyChain-BEC-Withdrawal-and-Trading-Suspended

Known Exploited Vulnerability Information

Source	Added Date
CVE	2018-04-23 04:00:00 UTC

Timeline

CVE ID Reserved

April 22, 2018
CVE Published to Public

April 23, 2018
Added to KEVIntel

April 23, 2018