Quantum Audit Logo
Launch App

Is Baby BFT Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Baby BFT BBFT
0xfb69…5769
BNB Chain
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The BBFT token is an ERC-20 standard token with additional configurable transfer mechanisms. The contract's ownership has been renounced, meaning many powerful administrative functions are now dormant and cannot be called. However, a designated 'treasuryaddress' retains significant control over certain operational parameters, including the ability to influence transfer rules, adjust swap thresholds, and manage treasury funds. This audit identified several medium and low-severity findings related to the active controls held by the 'treasuryaddress'.

3 Medium1 Low4 Informational
Volume 24h
$48.5K
Liquidity
$84.0K
Price
$0.0001866
Token Age
1y
Top 10 Holders
45.5%

Security Findings

3 Med1 Low4 Info
Medium

Treasury Address Can Influence Transfer Rules Related to Swaps

CP-05The `treasuryaddress` has the ability to call the `manualSwap()` function. This function can temporarily activate or deactivate certain swap-related transfer rules by setting an internal 'swapping' flag. While the `owner` role, which could control other transfer switches like `enableTrading` and `removeLimits`, has been renounced, the `treasuryaddress` still retains this specific control over swap-related transfers.
IssueThe `treasuryaddress` has the ability to call the `manualSwap()` function. This function can temporarily activate or deactivate certain swap-related transfer rules by setting an internal 'swapping' flag. While the `owner` role, which could control other transfer switches like `enableTrading` and `removeLimits`, has been renounced, the `treasuryaddress` still retains this specific control over swap-related transfers.
FixToken holders should be aware that the `treasuryaddress` can influence how tokens are processed during swaps by using the `manualSwap()` function. It is important to trust the entity controlling the `treasuryaddress` to manage this responsibly and transparently.
StatusUnresolved
Medium

Treasury Address Can Influence Token Fees for Treasury Operations

CP-07The `treasuryaddress` can call the `manualSwap()` function, which has the capability to influence the amount of tokens collected for the treasury (referred to as `tokensForTreasury`). This effectively allows the `treasuryaddress` to adjust a portion of the fees or taxes applied to certain transactions that contribute to the treasury. While the `owner` role, which could directly update `buyFee` and `sellFee`, has been renounced, the `treasuryaddress` retains this indirect control over treasury-related fees.
IssueThe `treasuryaddress` can call the `manualSwap()` function, which has the capability to influence the amount of tokens collected for the treasury (referred to as `tokensForTreasury`). This effectively allows the `treasuryaddress` to adjust a portion of the fees or taxes applied to certain transactions that contribute to the treasury. While the `owner` role, which could directly update `buyFee` and `sellFee`, has been renounced, the `treasuryaddress` retains this indirect control over treasury-related fees.
FixToken holders should understand that the `treasuryaddress` can affect the amount of tokens directed to the treasury through the `manualSwap()` function. Transparency from the `treasuryaddress` regarding its use of this function is recommended.
StatusUnresolved
Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a contract, 0x08f8…e52d — holds 99.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.
Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a contract, 0x08f8…e52d — holds 99.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Low

Treasury Address Can Change Swap Thresholds

CP-08The `treasuryaddress` has the ability to call the `updateSwapThreshold(uint256 newAmount)` function. This function allows the `treasuryaddress` to change the `swapTokensAtAmount` value, which dictates the minimum amount of tokens that must be accumulated before an automatic swap is triggered. While the `owner` role, which could control other limits like `maxWalletAmount`, `maxSellAmount`, and `maxBuyAmount`, has been renounced, the `treasuryaddress` still controls this specific operational threshold.
IssueThe `treasuryaddress` has the ability to call the `updateSwapThreshold(uint256 newAmount)` function. This function allows the `treasuryaddress` to change the `swapTokensAtAmount` value, which dictates the minimum amount of tokens that must be accumulated before an automatic swap is triggered. While the `owner` role, which could control other limits like `maxWalletAmount`, `maxSellAmount`, and `maxBuyAmount`, has been renounced, the `treasuryaddress` still controls this specific operational threshold.
FixToken holders should be aware that the `treasuryaddress` controls the `swapTokensAtAmount` threshold, which influences the token's liquidity management. The `treasuryaddress` should be a trusted entity that manages this parameter in the best interest of the token ecosystem.
StatusUnresolved
Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 45.5% of supply. Of that, 3.2% burned, 2.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 40.1% in wallets, 0.0% in other contracts. 22,707 holders in total.
IssueThe ten largest holders own 45.5% of supply. Of that, 3.2% burned, 2.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 40.1% in wallets, 0.0% in other contracts. 22,707 holders in total.
FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
StatusAcknowledged
Info

Listed, but not independently verified

QA-IDENTITYListed on CoinGecko as Baby BFT (BBFT), market cap $2M, rank #2450. 22,707 holders.
IssueListed on CoinGecko as Baby BFT (BBFT), market cap $2M, rank #2450. 22,707 holders.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

The market for this token

QA-MARKETLiquidity $93K (DexScreener, all pools). 24h trading volume $36K (CoinGecko, all markets, daily snapshot). 24h trading volume $52K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.00794 on 2025-10-08; the price is now 97.6328% below it.
IssueLiquidity $93K (DexScreener, all pools). 24h trading volume $36K (CoinGecko, all markets, daily snapshot). 24h trading volume $52K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.00794 on 2025-10-08; the price is now 97.6328% below it.
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

Asset class: Project token

QA-PROFILEA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 4% on buy, 5% on sell. Market: $93K of DEX liquidity across 2 pools. Launch: 462 days of market history.
IssueA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 4% on buy, 5% on sell. Market: $93K of DEX liquidity across 2 pools. Launch: 462 days of market history.
FixCheck the project's own documentation for what the token is used for; this report covers what the contract allows.
StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The BBFT contract implements the ERC-20 standard, providing core token functionalities like `transfer` and `balanceOf`. The technical architecture includes mechanisms to control token transfers through various switches, fees, and limits (7.1 Architecture). While the `owner` role is renounced, the `treasuryaddress` can still activate/deactivate swap-related transfer rules via `manualSwap()` (CP-05) and adjust the `swapTokensAtAmount` threshold via `updateSwapThreshold()` (CP-08). The contract also allows the `treasuryaddress` to influence fees related to treasury operations (CP-07).

GovernanceHigh1/10

The governance and economic model of the BBFT token is significantly shaped by the renounced ownership (7.5 Governance). This means that functions like `updateMaxBuyAmount`, `updateSellFee`, and `enableTrading` are no longer callable, reducing centralized control. However, the `treasuryaddress` maintains active control over critical economic parameters (7.4 Economic). This includes the ability to change the `swapTokensAtAmount` threshold, which impacts liquidity management, and to manually trigger swaps that affect `tokensForTreasury` (CP-07, CP-08). The `treasuryaddress` can also withdraw stuck ETH and foreign tokens (7.8 Operations).

UpgradesMedium6/10

The BBFT contract is not implemented as a proxy and therefore does not support upgradeability (7.7 Upgrades). This means the contract's logic is immutable once deployed, providing certainty that its behavior will not change unexpectedly. Any future modifications would require a new contract deployment and a migration of token holders.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax4.0%Sell Tax5.0%

Holder Composition

45.5% in top 10
40.1% in wallets0.0% in contracts
Effective Concentration40.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$93.2K across 2 pairs
Pancakeswap v2WBNBanalysed$84.0K90.1%0xf8ED…A0d9WBNB$9.3K9.9%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.0%
Top-3 Unlocked100.0%

Key Addresses

4 addresses
Deployer
0x9fc2…3828
Unlocked LP Held By
0x08f8…e52d0x1111…e5ec0x9fc2…3828

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

What Raised This Score

5 factors
  • A privileged address controls a switch that decides whether transfers go through; held by treasuryaddress: EOA
  • Owner can change the buy/sell tax; held by treasuryaddress: EOA
  • A privileged address can change transfer or wallet limits; held by treasuryaddress: EOA
  • Liquidity NOT locked (100% of the pool; this pool is 90% of DEX liquidity) — withdrawable by the owner/deployer — rug-pull risk
  • Top-10 concentration > 30% (45.5% total → 40.1% effective; 40.1% in EOAs, 0.0% in contracts; 5.4% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
金蟾 (JIN)High RiskbStocks Never Sleep (BSTOCKS)High RiskWorldMobileToken (WMTX)High RiskZypher Token (POP)High RiskSOLANA (SOL)High RiskSTBL_Token - STBL Governance Token (STBL)High Risk

Would You Like a More Detailed Audit of Baby BFT?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit