Discovery Trending Launches KYC Verified Watchlist Risk Alerts
Token Minter AI Threat Detection Token Burner
Blog & News Docs Visit SolidProof.io

BullBucket Info

bbtoken.io

TBA

BullBucket Logo
Onboarded date 02/12/2025

TrustNet Score

The TrustNet Score evaluates crypto projects based on audit results, security, KYC verification, and social media presence. This score offers a quick, transparent view of a project's credibility, helping users make informed decisions in the Web3 space.

80.00
Poor Excellent

Real-Time Threat Detection

Real-time threat detection, powered by Cyvers.io, is currently not activated for this project.

This advanced feature provides continuous monitoring and instant alerts to safeguard your assets from potential security threats. Real-time detection enhances your project's security by proactively identifying and mitigating risks. For more information, click here.

Security Assessments

"Static Analysis Dynamic Analysis Symbolic Execution SWC Check Manual Review"
Contract address
0xa821...16B9
Network
BNB Smart Chain - Testnet
License N/A
Compiler N/A
Type N/A
Language Solidity
Onboard date 2025/12/02
Revision date 2025/12/03

Summary and Final Words

No crucial issues found

The contract does not contain issues of high or medium criticality. This means that no known vulnerabilities were found in the source code.

Contract owner cannot mint

It is not possible to mint new tokens.

Contract owner cannot blacklist addresses.

It is not possible to lock user funds by blacklisting addresses.

Contract owner cannot set high fees

The fees, if applicable, can be a maximum of 25% or lower. The contract can therefore not be locked. Please take a look in the comment section for more details.

Contract cannot be locked

Owner cannot lock any user funds.

Token cannot be burned

There is no burning within the contract without any allowances

Ownership is not renounced

The owner retains significant control, which could potentially be used to modify key contract parameters.

Contract is not upgradeable

The contract does not use proxy patterns or other mechanisms to allow future upgrades. Its behavior is locked in its current state.

Scope of Work

This audit encompasses the evaluation of the files listed below, each verified with a SHA-1 Hash. The team referenced above has provided the necessary files for assessment.

The auditing process consists of the following systematic steps:

  1. Specification Review: Analyze the provided specifications, source code, and instructions to fully understand the smart contract's size, scope, and functionality.
  2. Manual Code Examination: Conduct a thorough line-by-line review of the source code to identify potential vulnerabilities and areas for improvement.
  3. Specification Alignment: Ensure that the code accurately implements the provided specifications and intended functionalities.
  4. Test Coverage Assessment: Evaluate the extent and effectiveness of test cases in covering the codebase, identifying any gaps in testing.
  5. Symbolic Execution: Analyze the smart contract to determine how various inputs affect execution paths, identifying potential edge cases and vulnerabilities.
  6. Best Practices Evaluation: Assess the smart contracts against established industry and academic best practices to enhance efficiency, maintainability, and security.
  7. Actionable Recommendations: Provide detailed, specific, and actionable steps to secure and optimize the smart contracts.

A file with a different Hash has been intentionally or otherwise modified after the security review. A different Hash may indicate a changed condition or potential vulnerability that was not within the scope of this review.

Final Words

The following provides a concise summary of the audit report, accompanied by insightful comments from the auditor. This overview captures the key findings and observations, offering valuable context and clarity.

Ownership Privileges
  • The owner can set the burn fee percentage up to 5%.
  • The owner can exclude/include wallets in burn fees.
  • The owner can add/remove wallets in the blacklist mapping.
  • The owner can pause/unpause the token transfer.
  • The owner can set the max transfer amount to any arbitrary value, excluding zero.
  • The owner can withdraw the BNB from the contract.
  • The owner can recover tokens from the contract.

Note - This Audit report consists of a security analysis of the BullBucket smart contract. This analysis did not include functional testing (or unit testing) of the contract’s logic. Moreover, we only audited one token contract for the BullBucket team. Other contracts associated with the project were not audited by our team. We recommend investors do their own research before investing.

Files and details

Functions
public

/

State variables
public

/

Total lines
of code

/

Capabilities
Hover on items

/

Findings and Audit result

Critical
High
Medium
Low
Optimization
Informational
critical Issues | 1 findings

Resolved

#1 critical Issue
transferOwnership Function is Unusable Due to Infinite Recursion
BulllBucket.sol
L595-603
Description

The transferOwnership function within the contract is critically flawed due to an infinite recursion bug. The function is designed to override the parent contract's behavior to add a check that prevents transferring ownership to a blacklisted address. However, instead of calling the parent contract's function to execute the ownership change, it mistakenly calls itself. This creates an infinite loop, causing any attempt to transfer ownership to fail by running out of gas. As a result, this core administrative function is unusable, and the contract ownership is permanently locked to the original deploying address.

Comments

The vulnerability can be corrected by modifying the recursive call to instead invoke the parent contract's implementation. The erroneous line, transferOwnership(newOwner);, must be replaced with super.transferOwnership(newOwner);. This change ensures that after the blacklist check is performed, the intended logic from the inherited Ownable2Step contract is executed, allowing the ownership transfer to complete successfully. Applying this fix is essential to restore the intended administrative control and security of the contract.

medium Issues | 4 findings

Resolved

#1 medium Issue
Owner Can Effectively Block Transfers by Setting a Low Maximum Transfer Amount
BulllBucket.sol
L490-495
Description

The setMaxTransferAmount function grants the contract owner the authority to limit the number of tokens that can be moved in a single transaction. While the function correctly ensures the amount is greater than zero, it does not enforce a reasonable minimum threshold. A malicious or compromised owner could exploit this by setting the maximum transfer amount to a trivial value, such as 1 wei. This action would cause all economically meaningful transactions to fail because they would exceed the allowed limit, effectively halting token transfers and trapping user funds. This gives the owner a subtle but powerful mechanism to freeze the token ecosystem, similar in effect to the pause functionality.

Comments

This functionality is a deliberate design choice that represents a significant centralization risk. The primary mitigation strategies are based on governance and transparency rather than a simple code change. The project team should clearly disclose this power to the community, ensuring all token holders are aware that the owner can impose such restrictions. For a more robust solution, control over this function should be decentralized. Placing the setMaxTransferAmount function under a Timelock contract would introduce a mandatory delay before any change takes effect, giving users advance warning and time to react. Alternatively, ownership could be transferred to a multi-signature wallet or a DAO, requiring consensus for administrative changes and protecting the system from a single point of failure.

Resolved

#2 medium Issue
Owner Can Unilaterally Freeze All Token Transfers
BulllBucket.sol
L480-482
Description

The contract grants the owner the ability to pause all core token functionalities at any moment. When activated, this feature blocks all transfers, approvals, and other key interactions with the token, effectively freezing the assets of every holder. While intended as a security measure for emergencies, this mechanism is a powerful tool of centralized control. It gives a single entity the unilateral power to halt all market activity and lock user funds indefinitely. This concentration of power poses a significant risk, as a malicious or compromised owner could abuse the function to manipulate the market or hold user assets hostage.

Comments

This centralization risk is inherent to the contract's design and should be addressed through transparent governance and decentralized controls. It is essential that the project's documentation and community communication clearly disclose the owner's ability to pause the contract. To build trust and reduce the risk of abuse, the control over the pause function should be decentralized. Implementing a Timelock contract would introduce a mandatory delay before a pause can be executed, giving the community time to respond. For a higher level of security, transferring ownership to a multi-signature wallet or a DAO would require consensus from multiple keyholders to pause the contract, thereby protecting the ecosystem from a single point of failure.

Resolved

#3 medium Issue
Owner Can Impose Exorbitant Transaction Fees up to 50%
BulllBucket.sol
L342-346
Description

The setBurnFeePercentage function gives the contract owner the unilateral power to impose a burn fee of up to 50% on every token transfer. This is a significant centralization risk, as it allows a single entity to control a critical aspect of the token's economy. A malicious or compromised owner could set the fee to the maximum level, which would make trading or using the token prohibitively expensive. Such an action would severely penalize token holders, deter market activity, and effectively act as a "soft-lock" on user funds by making them too costly to move. This powerful feature requires complete trust in the owner's intentions and security.

Comments

The risk associated with this function should be mitigated by decentralizing its control and ensuring transparency. The project team must be explicit with the community about the owner's ability to set such a high fee. For a more trust-minimized solution, the function should be placed under the control of a Timelock contract. This would introduce a mandatory delay before any fee change takes effect, allowing the community to see the change in advance and react accordingly. An even more secure mitigation would be to transfer contract ownership to a multi-signature wallet or a DAO, which would require consensus from multiple stakeholders to approve any change to the fee, protecting the ecosystem from the risk of a single point of failure.

Resolved

#4 medium Issue
The owner can blacklist wallets.
BulllBucket.sol
L440-447
Description

The contract includes a mechanism that allows the owner to blacklist any arbitrary wallet address. Once blacklisted, the affected wallet is prevented from transferring tokens. This introduces a significant centralization and censorship risk, as the contract owner could—intentionally or unintentionally—restrict token holders from accessing or moving their assets for an indefinite period. Such unilateral control compromises user trust, limits decentralization, and may negatively impact the token’s utility and market behavior.

Comments

To reduce the risks associated with arbitrary wallet blacklisting, the contract should limit blacklist control to a multisignature wallet or a governance-based mechanism instead of a single EOA, ensuring no single actor can misuse this authority. Additionally, the blacklisting process should be transparent and time-bound by introducing temporary suspension periods rather than indefinite restrictions. Emitting clear, detailed events for every blacklist and removal action further enhances accountability. Implementing predefined conditions for applying or lifting a blacklist and allowing community or governance voting to approve such actions can also prevent abuse. These measures collectively ensure the feature cannot be exploited, maintain decentralization, and protect users from unjust or permanent transfer restrictions.

informational Issues | 1 findings

Resolved

#1 informational Issue
Floating pragma solidity version.
BulllBucket.sol
L2
Description

Adding the constant version of solidity is recommended, as this prevents the unintentional deployment of a contract with an outdated compiler that contains unresolved bugs.