Vulnerabilities > CVE-2018-12885 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Mycryptochamp
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a private variable, (which can be read with a getStorageAt call). Therefore, attackers can get powerful champs/items and get rewards.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |