CVE-2018-17877

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.

• CWE-338

• https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17877Exploit, Third Party Advisory
• https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17877Exploit, Third Party Advisory

Published

Oct 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17871Verba Collaboration Compliance and Quality Management Platfo…6.5
• CVE-2018-17872Verba Collaboration Compliance and Quality Management Platfo…
• CVE-2018-17873An incorrect access control vulnerability in the FTP configu…
• CVE-2018-17874ExpressionEngine before 4.3.5 has reflected XSS.
• CVE-2018-17875A remote code execution issue in the ping command on Poly Tr…8.8
• CVE-2018-17876A Stored XSS vulnerability has been discovered in the v5.5.0…
• CVE-2018-17878Buffer Overflow vulnerability in certain ABUS TVIP cameras a…9.8
• CVE-2018-17879An issue was discovered on certain ABUS TVIP cameras. The CG…9.8
• CVE-2018-1788IBM Spectrum Protect Server 7.1 and 8.1 could disclose highl…4.1
• CVE-2018-17880On D-Link DIR-823G 2018-09-19 devices, the GoAhead configura…
• CVE-2018-17881On D-Link DIR-823G 2018-09-19 devices, the GoAhead configura…
• CVE-2018-17882An Integer overflow vulnerability exists in the batchTransfe…