CVE-2025-57247

The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics.

• CWE-284

• https://bscscan.com/address/0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2#code
• https://github.com/RikkaLzw/CVE/blob/main/CVE_BATB-TOKEN.md

Published

Oct 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57220An input validation flaw in the 'ate' service of Tenda AC10 …5.3
• CVE-2025-57227An unquoted service path in Kingosoft Technology Ltd Kingo R…7.8
• CVE-2025-5723A vulnerability was found in SourceCodester Student Result M…4.8
• CVE-2025-5724A vulnerability was found in SourceCodester Student Result M…4.8
• CVE-2025-57240Cross site scripting (XSS) vulnerability in 17gz Internation…6.1
• CVE-2025-57244OpenKM Community Edition 6.3.12 is vulnerable to stored cros…5.4
• CVE-2025-57248A null pointer dereference vulnerability was discovered in S…7.3
• CVE-2025-5725A vulnerability was found in SourceCodester Student Result M…4.8
• CVE-2025-57254An SQL injection vulnerability in user-login.php and index.p…6.5
• CVE-2025-5726A vulnerability was found in SourceCodester Student Result M…5.4
• CVE-2025-57263An authenticated SQL injection vulnerability in VX Guestbook…7.2
• CVE-2025-57266An issue was discovered in file AssistantController.java in …9.8