An integer underflow has been found in the latest version of ZCFees. The variables ‘currPeriodIdx’ and ‘lastPeriodExecIdx’ are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24837
Reference (s):
- https://etherscan.io/address/0x9d79c6e2a0222b9ac7bfabc447209c58fe9e0dcc#code