BabyPepe

CertiK1 address on BNB Chain

CertiK reviewed BabyPepe on 6 May 2024: 8 findings, 0 critical; 3 marked fixed, 1 acknowledged, 4 open.

No open critical findings
Open the reportOpen BabyPepe’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High011
Medium000
Low402
HighCentralization Risks in BabyPepe.solFixed

In the contract `BabyPepe` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - call `claimStuckTokens()` to claim stuck tokens. - call `excludeFromFees()` to exclude accounts from fees - call `updateBuyFees()` to change buy fee - call `updateSellFees()` to change sell fee - call `updateWalletToWalletTransferFee()` to change transfer fee - call `changeMarketingWallet()` to change marketing wallet that receives marketing fee share - call `setSwapEnabled()` to enable the allocation of trade fees for: 1. add liquidity; 2. transfer to marketing wallet - call `excludeFromMaxWallet()` to manage accounts for the maximum wallet limit - call `excludeFromMaxTransactionLimit()` to manage accounts for the maximum transaction limit - call `setPair()`, `pairIsSet()`, `setSwapTokensAtAmount()`, `setEnableMaxWalletLimit()`, `setMaxWalletAmount()`, `setEnableMaxTransactionLimit()`, `setMaxTransactionAmounts()`, to set sensitive properties ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-017d-4a16e950-8724-03f993e8f926/diagrams/centralization_BabyPepe-BabyPepe-_owner.svg) In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-017d-4a16e950-8724-03f993e8f926/diagrams/centralization_BabyPepe-Ownable-_owner.svg)

LowThe `enableTrading()` function sets DEX pair withFixed

The contract contains two functions, `setPair()` and `enableTrading()`, that set the `uniswapV2Pair` address. The `setPair()` function updates the `uniswapV2Pair` only when the `pairSet` flag is false, ensuring that the pair cannot be modified afterward. However, the `enableTrading()` function also updates the `uniswapV2Pair` without checking the state of the `pairSet` flag. This discrepancy could lead to unintended changes to the `uniswapV2Pair`, potentially allowing for operational errors.

LowThe `walletToWalletTransferFee` is locked if `_toFixed

The contract includes functionality for charging transfer fees if `walletToWalletTransferFee` is nonzero when BabyPepe tokens are transferred between wallets. However, a potential issue arises when both `_totalFeesOnBuy` and `_totalFeesOnSell` are set to zero. In this scenario, the contract fails to trigger the `swapAndLiquify()` and `swapAndSendMarketing()` processes. Consequently, if the `walletToWalletTransferFee` is charged, but these processes are not triggered, the charged fee remains locked within the contract.

Contracts in scope1

AddressChainSource code
0x9d6db6382444b70a51307a4291188f60d4eef205Chain: BNB ChainSource code: Verified source

Part of BabyPepe’s security record

BabyPepe
Audits1 audit by 1 firmLast audit May 2024, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open BabyPepe’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us