CVE-2025-57247 Details
Description
The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics.
A vulnerability has been identified in the BATBToken smart contract on the Binance Smart Chain. The issue arises from improper access control in whitelist management functions, specifically in the setColdWhiteList() and setSpecialAddress() methods inherited from the ERC20 base contract. These functions are public and lack necessary access control modifiers, enabling any user to manipulate transfer restrictions and special address settings. This flaw could disrupt the contract's dividend distribution mechanisms and lead to unauthorized privileges, undermining the intended tokenomics.
Implement proper access control modifiers, such as onlyOwner, for the affected whitelist management functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 6, 2025CISA-ADP
Assessed Oct 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bscscan.com/address/0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2#code | [email protected] | Source Code |
| https://github.com/RikkaLzw/CVE/blob/main/CVE_BATB-TOKEN.md | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| BATBToken | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 6, 2025 | CVE Modified | CISA-ADP |
| Oct 6, 2025 | New CVE Received | [email protected] |