CVE-2018-14086
📋 TL;DR
This vulnerability allows attackers to exploit an integer overflow in the SingaporeCoinOrigin (SCO) Ethereum smart contract. When the owner sets an excessively high sellPrice value, the multiplication in the sell() function overflows, potentially allowing attackers to manipulate token balances or steal funds. Anyone holding or transacting with the vulnerable SCO token contract is affected.
💻 Affected Systems
- SingaporeCoinOrigin (SCO) Ethereum token smart contract
📦 What is this software?
Mytoken by Mytoken Project
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of funds from the smart contract, token manipulation allowing unlimited minting or theft, and permanent damage to token economics and investor trust.
Likely Case
Token holders lose funds through manipulated transactions, contract owner loses control over pricing mechanisms, and token value collapses due to loss of confidence.
If Mitigated
If proper overflow checks were implemented, the transaction would revert safely, preventing any financial loss while maintaining contract integrity.
🎯 Exploit Status
Exploitation requires calling the vulnerable sell() function after the owner sets a malicious sellPrice. Public proof-of-concept exists in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Deploy a new, fixed version of the smart contract with proper overflow checks using SafeMath library. 2. Migrate all token holders to the new contract. 3. Abandon the vulnerable contract address.
🔧 Temporary Workarounds
Contract Owner Price Limitation
allContract owner should avoid setting sellPrice to extremely high values that could cause overflow
N/A
Token Holder Transaction Monitoring
allToken holders should monitor for unusual price settings and avoid selling when suspicious values are detected
N/A
🧯 If You Can't Patch
- Immediately stop all trading and transfers involving the vulnerable SCO token
- Communicate the risk to all token holders and recommend moving to alternative, secure tokens
🔍 How to Verify
Check if Vulnerable:
Review smart contract source code for missing overflow checks in sell() function when multiplying amount * sellPriceCheck Version:
Check Ethereum contract address and verify it matches the fixed contract deploymentVerify Fix Applied:
Verify new contract uses SafeMath library or explicit overflow checks for all arithmetic operations📡 Detection & Monitoring
Log Indicators:
- Unusually large sellPrice settings in contract events
- Failed transactions due to overflow reverts
- Abnormal token balance changes
Network Indicators:
- High gas usage for sell transactions
- Multiple failed sell attempts from same addresses
SIEM Query:
N/A for blockchain transactions - monitor using blockchain explorers and smart contract event logs