Web3 · Ethereum · Beauty Ecosystem Coin (BEC)
On 22 April 2018 the Beauty Ecosystem Coin (BEC) ERC-20 token on Ethereum was drained by the classic batchOverflow attack, generating roughly 10^58 BEC and collapsing the token's value. The vulnerable batchTransfer(_receivers, _value) computed amount = cnt * _value in unchecked Solidity 0.4.x arithmetic, where cnt was the receiver count. The attacker passed two receivers with _value = 0x8000...0000 (2^255), so amount = 2 * 2^255 overflowed uint256 back to zero. That zero total passed the require(_value > 0 && balances[msg.sender] >= amount) balance check, yet the loop still credited each of the two receivers 2^255 tokens. This is a textbook unchecked integer (multiplication) overflow, assigned CVE-2018-10299, and it triggered the discovery of the same batchOverflow pattern in dozens of other ERC-20 contracts.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.