CVE-2019-15080
📋 TL;DR
A typographical error in the constructor of the Owned smart contract allows attackers to claim ownership of the MORPH Token contract. This enables malicious actors to mint unlimited tokens for free and potentially perform denial-of-service attacks. Anyone holding or interacting with MORPH Token contracts through June 5, 2019 is affected.
💻 Affected Systems
- MORPH Token smart contract
📦 What is this software?
Morph by Morph Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the token contract allowing unlimited token minting, theft of all funds, and permanent denial of service.
Likely Case
Attacker gains contract ownership and mints tokens for personal profit, devaluing the token for legitimate holders.
If Mitigated
No impact if contract has been properly audited and deployed without the typo vulnerability.
🎯 Exploit Status
Exploitation requires blockchain transaction submission but no authentication. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not applicable
Vendor Advisory: https://github.com/smsecgroup/SM-VUL/tree/master/typo-vul-02
Restart Required: No
Instructions:
1. Deploy new contract with corrected constructor. 2. Migrate token holders to new contract. 3. Abandon vulnerable contract. Note: Smart contracts are immutable once deployed.
🔧 Temporary Workarounds
Contract migration
allDeploy corrected contract and migrate all token holders
Not applicable - requires manual smart contract deployment
🧯 If You Can't Patch
- Cease all interactions with vulnerable contract address
- Monitor for suspicious ownership transfer transactions
🔍 How to Verify
Check if Vulnerable:
Review contract source code for constructor typo in Owned contract inheritanceCheck Version:
Check contract creation date and verify it's after 2019-06-05Verify Fix Applied:
Verify new contract has correct constructor and ownership cannot be transferred unexpectedly📡 Detection & Monitoring
Log Indicators:
- Unexpected ownership transfer events in contract logs
- Unusual token minting transactions
Network Indicators:
- Transactions calling vulnerable constructor function
- Suspicious contract interactions from unknown addresses
SIEM Query:
Not applicable - blockchain transactions not typically monitored by traditional SIEM