CVE-2018-19834

Vulnerability

The quaker function in the BOMBBA (BOMB) ERC20 token contract lacks access control, allowing any caller to change the contract owner [1]. The contract does not use an onlyOwner modifier or equivalent. Affected is the deployed implementation of the BOMBBA token.

Exploitation

An attacker simply calls the quaker function with a new owner address [1]. No authentication, special privileges, or user interaction is required; any Ethereum account can execute the call.

Impact

Upon success, the attacker becomes the contract owner and gains access to all owner-restricted functions (e.g., withdraw, transferOwnership), enabling theft of all tokens or Ether held by the contract [1].

Mitigation

As of the available references, no official fix has been released [1]. Users should avoid the unpatched contract and consider deploying a corrected version with proper access control on the quaker function.