CVE-2018-19831

Vulnerability

The Cryptbond Network (CBN) ERC20 token smart contract contains a vulnerability in the ToOwner() function. This function is designed to change the contract owner but lacks any access control, such as a modifier to verify the caller's identity. As a result, any Ethereum address can call ToOwner() and transfer ownership to any address of their choice. Affected versions include all deployments of the CBN token contract prior to any fix [1].

Exploitation

An attacker only needs to know the contract's address and call the ToOwner() function directly from any Ethereum account. No authentication, prior access, or user interaction is required. The attacker can specify any new owner address, effectively taking control of the contract [1].

Impact

By becoming the owner, the attacker gains full control over the smart contract, including the ability to withdraw any Ether or other tokens held by the contract, pause transfers, or modify critical parameters. This can lead to total financial loss for the token holders and the original project [1].

Mitigation

The vulnerability is inherent in the contract code and cannot be mitigated without deploying a new contract or implementing an upgrade mechanism. Projects that have not yet deployed should ensure that sensitive functions like ToOwner() include the onlyOwner modifier. For existing deployments, users should discontinue use of the CBN token and migrate to a fixed version if available. No official patch has been announced as of the publication date (2019-12-31) [1].