CertiK reviewed BackedBy (BackedBy - Audit) on 4 Jan 2023: 6 findings, 0 critical; 5 marked fixed, 1 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 4 |
There are several privileged roles within the contracts that control access to significant administrative functions. #### Owner In the contract `BBSubscriptionsFactory` the role `_owner` has authority over the functions shown in the diagram and the list below: * setTreasury() - Set treasury address * setSubscriptionGasRequirement() - Set the subscription gas requirement for a specific currency Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to set important contract parameters.  In the contract `BBSubscriptions` the role `_owner` has authority over the functions shown in the diagram and the list below: * setSubscriptionGasRequirement() - Set the subscription gas requirement Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to set important contract parameters.  #### Profile Owner In the contract `BBSubscriptionsFactory` the role `profileOwner` has authority over the functions shown in the diagram and the list below: * createSubscriptionProfile() - Set up a new subscription profile * setContribution() - Set a subscription profile's treasury contribution percentage Any compromise to the `profileOwner` account may allow the hacker to take advantage of this authority to set important contract parameters.  In the contract `BBTiers` the role `profileOwner` has authority over the functions shown in the diagram and the list below: * createTiers() - Create new tier level * editTiers() - Edit existing tier levels * setSupportedCurrencies() - Set supported ERC20 tokens for payments Any compromise to the `profileOwner` account may allow the hacker to take advantage of this authority to set important contract parameters.  In the contract `BBPosts` the role `profileOwner` has authority over the functions shown in the diagram and the list below: * createPost() - Create a new post * editPost() - Edit existing post variables Any compromise to the `profileOwner` account may allow the hacker to take advantage of this authority to create and edit posts.  In the contract `BBProfiles` the role `profileOwner` has authority over the functions shown in the diagram and the list below: * editProfile() - Edit existing profile variables Any compromise to the `profileOwner` account may allow the hacker to take advantage of this authority to edit profiles. 
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (13)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us