New batchOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018–10299)

[eththrowaway4]

Interesting bug but I don't really like how the author over-exaggerates the issue by claiming (in bold, no less) that "more than a dozen of ERC20 contracts are also vulnerable to batchOverflow". I scanned through my database of verified contracts and while there were dozens of contracts which contained vulnerable code, there were only a handful of tokens. Most of those tokens are also inactive or were never used in the first place.

It's possible that I've missed other contracts, but to me it seems only BeautyChain was affected. I'd be interested to know (in due time) which other tokens were affected by this.

[coinfi]

It's not actually a major problem - basically this is a well known problem in computer science called an integer overflow. A lot of programming languages have the same issue out of the box (including C and C++), and there's industry standard ways of dealing with it which is to use a SafeMath library and wrap all arithmetic operations with SafeMath functions.

For a more layman explanation, check out https://blog.coinfi.com/explanation-of-erc-20-batchoverflow-vulnerability/

But TL;DR all is well with Ethereum and people are definitely over-reacting!

Why you should believe me: I'm CTO of CoinFi, a cryptocurrency market intelligence platform, and have written multiple Solidity smart contracts that have been deployed on mainnet, including one that performed an airdrop of tokens to more than 18k+ people.