PT-2025-40907 · Batbtoken · Batbtoken

Rikkalzw · Published 2025-10-06 · Updated 2025-10-06 · CVE-2025-57247

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions BATBToken smart contract versions prior to Compiler Version v0.8.26+commit.8a97fa7a

Description The BATBToken smart contract, with address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, has an incorrect access control implementation in its whitelist management functions. Specifically, the setColdWhiteList() and setSpecialAddress() functions within the base ERC20 contract are publicly accessible without appropriate access control modifiers. This allows any user to bypass transfer restrictions and manipulate special address settings. Exploitation of this issue could enable unauthorized users to circumvent cold time transfer restrictions and disrupt dividend distribution mechanisms, potentially leading to privilege escalation and a violation of the contract’s intended tokenomics.

Recommendations Apply access control modifiers to the setColdWhiteList() and setSpecialAddress() functions to restrict access to authorized users only.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-57247

Affected Products

Batbtoken

References · 5

• 🔥 https://github.com/RikkaLzw/CVE/blob/main/CVE_BATB-TOKEN.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57247 · Security Note
• https://t.me/CVEtracker/34248 · Telegram Post
• https://bscscan.com/address/0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2#code · Note
• https://twitter.com/CVEnew/status/1975234272102662501 · Twitter Post