CVE-2020-19765
📋 TL;DR
CVE-2020-19765 is a reentrancy vulnerability in the Accounting 1.0 Ethereum smart contract's noReentrance() modifier. Attackers can exploit this to drain funds from the contract by repeatedly calling functions before previous calls complete. This affects any system using the vulnerable Accounting 1.0 contract.
💻 Affected Systems
- Accounting Ethereum Smart Contract
📦 What is this software?
Proofofdiligencetoken by Proofofdiligencetoken Project
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of all funds stored in the vulnerable smart contract through repeated withdrawals.
Likely Case
Partial or complete fund theft from the contract by attackers monitoring for vulnerable deployments.
If Mitigated
No impact if contract uses proper reentrancy guards or has been patched.
🎯 Exploit Status
Reentrancy attacks are well-known in Ethereum, and proof-of-concept code exists in the references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Deploy a new version of the contract with proper reentrancy protection. 2. Migrate all funds and users to the new contract. 3. Mark the old contract as deprecated.
🔧 Temporary Workarounds
Implement Checks-Effects-Interactions Pattern
allRewrite contract functions to follow the checks-effects-interactions pattern to prevent reentrancy.
N/A - Requires contract code modification
Use ReentrancyGuard from OpenZeppelin
allImport and use the ReentrancyGuard contract modifier from OpenZeppelin library.
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
🧯 If You Can't Patch
- Monitor contract for suspicious transactions and set up alerts for unusual withdrawal patterns.
- Consider using a multisig wallet or time-locked withdrawals to limit potential damage.
🔍 How to Verify
Check if Vulnerable:
Review contract source code for the noReentrance() modifier implementation and check if it properly prevents reentrant calls.Check Version:
Check contract address on Etherscan or similar explorer for deployed bytecode and verify against known vulnerable versions.Verify Fix Applied:
Verify the contract uses proper reentrancy guards (like OpenZeppelin's ReentrancyGuard) and follows checks-effects-interactions pattern.📡 Detection & Monitoring
Log Indicators:
- Multiple contract calls from same address in single transaction
- Unexpected balance changes in contract
Network Indicators:
- Unusual gas usage patterns in transactions
- Multiple internal calls within single transaction
SIEM Query:
N/A - Blockchain transactions require specialized monitoring tools