Vulnerability identifier: #VU49215
Vulnerability risk: High
CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID:
CWE-ID:
CWE-682
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
yCREDIT
Web applications /
Cryptocurrency software
Vendor: yCREDIT
Description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect calculation performed by the application. The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.
Note, the vulnerability has been exploited in the wild in January 2021.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
yCREDIT: All versions
External links
http://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3
http://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.