CVE-2018-17071

7.5 highEPSS 1.2%

High (7.5) in lucky9 lucky9io. EPSS 1.2% chance of exploitation in the next 30 days.

The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entry_number. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a ticket at a low price by directly calling the fallback function with small msg.value, because the developer set the currency unit incorrectly. Therefore, it allows attackers to always win and get rewards.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-338
Published: 2018-09-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lucky9:lucky9io

References

https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17071
https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17071

Check your stack JSON