CVE-2025-57247

{
  "id": "CVE-2025-57247",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-06T17:16:05.697",
  "lastModified": "2026-11-05T23:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics."
    },
    {
      "lang": "es",
      "value": "El contrato inteligente BATBToken (dirección 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Versión del compilador v0.8.26+commit.8a97fa7a) contiene una implementación incorrecta de control de acceso en las funciones de gestión de listas blancas. Las funciones setColdWhiteList() y setSpecialAddress() en el contrato base ERC20 están declaradas como públicas sin los modificadores de control de acceso adecuados, lo que permite a cualquier usuario eludir las restricciones de transferencia y manipular la configuración de direcciones especiales. Esto permite a usuarios no autorizados eludir las restricciones de transferencia de tiempo frío y potencialmente interrumpir los mecanismos de distribución de dividendos, lo que lleva a la escalada de privilegios y a la violación de la tokenómica prevista del contrato."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-06T17:20:38.882462Z",
          "id": "CVE-2025-57247",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bscscan.com/address/0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2#code",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RikkaLzw/CVE/blob/main/CVE_BATB-TOKEN.md",
      "source": "[email protected]"
    }
  ]
}