CVE-2018-15552: Theethereumlottery The Ethereum Lottery

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.

Affected products

• Theethereumlottery The Ethereum Lottery: affected versions not specified

Published 2018-09-07. Last modified 2026-06-17.