CVE-2018-12056: All-For-One All For One

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the _seed value can be retrieved with a getStorageAt call. Therefore, it allows attackers to always win and get rewards.

Affected products

• All-For-One All For One: affected versions not specified

Published 2018-08-15. Last modified 2026-06-17.