Back to KEVs

CVE-2022-25335

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the...

Basic Information

CVE State
PUBLISHED
Reserved Date
February 18, 2022
Published Date
February 18, 2022
Last Updated
August 03, 2024
Vendor
n/a
Product
n/a
Description
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

5.0

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploit Status

Exploited in the Wild
Yes (2022-02-18 17:34:58 UTC) Source

References

https://twitter.com/RigoBlock/status/1494351180713050116 https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8 https://twitter.com/danielvf/status/1494317265835147272 https://raw.globalsecuritydatabase.org/GSD-2022-1000077

Known Exploited Vulnerability Information

Source Added Date
CVE 2022-02-18 17:34:58 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel