CVE-2018-13753

Vulnerability

The mintToken function in the DeWeiSecurityServiceToken smart contract contains an integer overflow vulnerability [1][2]. This allows the contract owner to set the balance of any user to an arbitrary value. The issue is present in the contract implementation as described in the CVE description and demonstrated in related token contracts [1].

Exploitation

An attacker who is the owner of the contract can exploit this vulnerability by calling mintToken with a large value that causes an integer overflow, thereby setting the balance of an arbitrary user to any desired amount. No other privileges or user interaction are required beyond ownership.

Impact

Successful exploitation allows the owner to arbitrarily increase or decrease any user's token balance, effectively giving them control over the token supply and distribution. This can lead to financial loss for users and undermine the token's integrity.

Mitigation

No official fix or patched version has been disclosed in the available references. The token contract should be considered vulnerable, and users are advised to avoid interacting with this token until a fix is applied.