The Patching Friars' AlmanacA calendar of CVE saints

April 25

proxyOverflowHoly card for proxyoverflow, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 2^256 proxyOverflow CALIX REDUNDAT
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint proxyOverflow, Multiplier of Tokens

Patron of ERC20 tokens, overflowing integers, and contracts that cannot be patched.

Life

On 25 April 2018 PeckShield described proxyOverflow, an integer overflow in the transferProxy function of the SmartMesh (SMT) token, already exploited in those days. Thanks to a sum that overflowed, someone found themselves holding an astronomical number of tokens created from nothing, and several exchanges suspended SMT deposits and trading. It came three days after its twin, batchOverflow: April 2018 was a month of arithmetic miracles.

Prayer

O Saint proxyOverflow, who multiplies tokens like loaves but without permission, let our contracts use SafeMath and count properly. Amen.

How to celebrate

Celebrated by checking every sum before doing it, and remembering that a deployed contract does not take patches.

An overflowing sum makes a swollen purse.

Technical record

Disclosed on
April 25 2018
CVE
CVE-2018-10376

An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the "proxyOverflow" issue.

Sources: peckshield.com · web.archive.org

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.