CVE-2018-13157

Vulnerability

The mintToken function in the CryptonitexCoin (CRTX) smart contract [2] lacks overflow protection, allowing integer overflow when minting tokens. This enables the contract owner to set an arbitrary user's balance to any value, as described in the CVE description. The same vulnerability pattern is documented in [1].

Exploitation

An attacker must be the contract owner. The owner calls mintToken with a large value that causes an integer overflow, bypassing balance limits. No special network access or user interaction is required, just a transaction from the owner's address.

Impact

The owner can arbitrarily set the balance of any user, effectively creating tokens out of thin air or debasing the token supply. This leads to loss of token value and potential theft of funds.

Mitigation

No fix has been disclosed in the available references. The contract remains unpatched. Users should avoid trusting this token. [1] demonstrates similar vulnerabilities, suggesting that developers should use the SafeMath library or similar to prevent overflows.