Security readout for executives and security teams
Plain-English summary
This CVE concerns an Ethereum token contract implementation for GoodTo (GTO). A flaw in the owner-controlled minting function can let the contract owner set any user's token balance to an arbitrary value, undermining token integrity and trust.
Executive priority
Prioritize review if the organization holds, integrates, lists, or accepts GoodTo/GTO tokens. Otherwise, track as a narrow blockchain integrity issue with uncertain real-world exposure.
Technical view
The reported issue is an integer overflow in the GoodTo/GTO smart contract mintToken function. The CVE description says the owner can use the flaw to set an arbitrary user's balance to any value. The source bundle does not provide CVSS, affected deployment identifiers, or a vendor fix.
Likely exposure
Exposure appears limited to the named GoodTo (GTO) Ethereum token smart contract implementation or derived contracts using the same mintToken logic. The bundle does not identify broader affected products, contract addresses, or versions.
Exploitation context
No active exploitation is cited, and the CVE is not listed as KEV in the bundle. The described capability is owner-controlled, so practical risk depends on contract deployment, owner key control, and whether downstream systems trust token balances.
Researcher notes
Evidence is sparse. The CVE names the vulnerable function and impact, but not a patched version, contract address, CVSS score, CWE, or confirmed exploitation. Treat findings as implementation-specific until independently mapped to deployed contracts.
Mitigation direction
- Identify whether your assets use the GoodTo/GTO contract implementation.
- Check project or vendor guidance for confirmed remediation or migration steps.
- Review owner key security and governance controls for affected deployments.
- Avoid relying on affected token balances until integrity is assessed.
Validation and detection
- Inventory contracts and integrations referencing GoodTo/GTO token logic.
- Review mintToken arithmetic for overflow protections and balance assignment behavior.
- Confirm whether deployed bytecode matches the vulnerable implementation.
- Check historical token supply and balance changes for unexplained anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-13079 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/VenusADLab/EtherTokens/blob/master/GoodTo/GoodTo.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.