CVE-2018-12702

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer the contract's balances into their account) because the callcode (i.e., _spender.call(_extraData)) is not verified, aka the "evilReflex" issue. NOTE: a PeckShield disclosure states "some researchers have independently discussed the mechanism of such vulnerability."

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://huobiglobal.zendesk.com/hc/en-us/articles/360000110521-HADAX-Suspends-18T-and-GVE-Deposits-and-WithdrawalsThird Party Advisory
https://peckshield.com/2018/06/23/evilReflex/Exploit, Third Party Advisory
https://huobiglobal.zendesk.com/hc/en-us/articles/360000110521-HADAX-Suspends-18T-and-GVE-Deposits-and-WithdrawalsThird Party Advisory
https://peckshield.com/2018/06/23/evilReflex/Exploit, Third Party Advisory

Timeline

Published: Jun 25, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-127037.5The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers to CVE-2018-127056.1DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).CVE-2018-127069.8DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.CVE-2018-12715.9Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configu CVE-2018-127108.0An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privileg CVE-2018-127116.1An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the curr CVE-2018-127128.8An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exist CVE-2018-127139.1GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demon CVE-2018-127149.8An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no CVE-2018-127156.1DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.CVE-2018-127164.3The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_resu CVE-2018-12727.5Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support f