Baby Doge security record
As of 3 Nov 2026, Baby Doge has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 2 Oct 2023. Those reports list no open critical findings. It also holds 2 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Baby Doge - NFT Farm | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Baby Doge DEX | Security firm: CertiK | Date: | Scope: 2 addresses on BNB Chain | No open critical findings | Open · skynet.certik.com |
Findings30
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 1 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 10 | 0 | 14 |
HighIncorrect Amount Used in SwapBaby Doge DEX · CertiK · 6 Oct 2022Fixed
In the function `swaptoBuyBack()`, the following code snippet is implemented to swap a certain amount of `WETH` for `buyBackCoin1`. However, the amount of `WETH` that is used to buy back the token is mistakenly set to `buyBackAmount0`, which should be `buyBackAmount1` ```solidity=337 if (buyBackCoin1 != address(0)) { address[] memory path = new address[](2); path[0] = WETH; path[1] = buyBackCoin1; uint256[] memory amountOutMin = IBabyDogeV2Router02(router) .getAmountsOut(buyBackAmount0, path); IBabyDogeV2Router02(router).swapExactTokensForTokens( buyBackAmount0, amountOutMin[1], path, address(this), block.timestamp + 120 ); } ```
Open the reportMediumDefinition of depositOnBehalfBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
The function `depositOnBehalf` calls `stakeToken.transferFrom` to send tokens from Msg.sender instead of the address `account`. Therefore the address `account` will receive the shares and the reward token instead of the message sender. Therefore the `account` must send tokens to Msg.sender before the Msg.sender calls `depositOnBehalf`. Otherwise the Msg.sender will lose their deposit tokens and previous rewards assuming Msg.sender and `account` are differing accounts. A similar issue can be found in `ERC20FarmFixed`, `ERC721FarmFixed`, and `ERC721Farm`.
Open the reportMediumInconsistant Deadline for SwapBaby Doge DEX · CertiK · 6 Oct 2022Fixed
In the function `swaptoBuyBack()`, the deadline for the `IBabyDogeV2Router02(router).swapExactTokensForTokens` is set to `block.timestamp + 1200`, which is 20 minutes more than the block.timestamp. However, other swap deadlines are all set to `block.timestamp + 120`, which brings the inconsistency
Open the reportLowComparison to Boolean ConstantBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
Boolean constants can be used directly and do not need to be compared to true or false.
Open the reportLowDifferent Solidity VersionsBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
Multiple Solidity versions are used in the codebase. Versions used: `^0.8.11`, `^0.8.0`
Open the reportLowLoss of Rewards from ReentrancyBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
For the `ERC20Farm.sol` and `ERC20FarmedFixEnd.sol`, there is a minor risk of a user claiming double rewards via reentrancy. Consider the following scenario: 1. Suppose the stakeToken contains a hook to an external contract for recipient verification. 2. Further suppose that Bob controls a contract that deposits X stakeToken at block 0. 3. At Block 100, Bob's contract then calls withdraw function which transfers the stakeToken. 4. Bob's contract would be able to reenter deposit using the hook. This would allow Bob to collect rewards based on the `withdrawal` call and then the `deposit` call. This would be an issue for ERC721 if safeTransferFrom was used. Further, nonReentrant modifier will not protect against this attack.
Open the reportLowMissing Zero Address ValidationBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
Addresses should be checked before assignment or external call to make sure they are not zero addresses.
Open the reportLowPotential Loss of Staked TokensBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
When calling the `deposit` function there is a potential loss of staked tokens given the following scenario: 1. If the following statement is true: `_amount` > `defaultStakePPS` 2. If `depositedAmount` < `defaultStakePPS` is true where `depositedAmount` = `subsequentBalance` - `initialBalance` Then `user.shares` will not record an updated amount.
Open the reportLowRequire Check TautologyBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
The initial require statement of the `deposit()` function always checks that `_amount` is larger then zero. Therefore the fourth require statement is always true.
Open the reportLowShadowing Local VariableBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
The owner parameter is shadowing the function `owner` in `Ownable`.
Open the reportShow 7 more
LowUnlocked Compiler VersionBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportLowUnused State VariableBaby Doge - NFT Farm · CertiK · 2 Oct 2023Fixed
The `feeReceiver` are not used in `ERC721FarmFixEnd` and in `ERC721Farm`.
Open the reportLow`stopReward()` May Prolong Mining ActivityBaby Doge DEX · CertiK · 6 Oct 2022Fixed
When the pool has stopped, the invocation of the function `stopReward()` may potentially extend the reward activity if `block.number` is given a value that is greater than the current `bonusEndBlock` by mistake. In this case, users can withdraw extra rewards which will cause a loss of the pool's assets.
Open the reportLow`updatePoolLimitPerUser()` Can Not Be ExecutedBaby Doge DEX · CertiK · 6 Oct 2022Fixed
Currently in the function `updatePoolLimitPerUser()`, once `hasUserLimit` was set to `false`, it can no longer be set to `true` through function `updatePoolLimitPerUser()`. Does this mean once the limit was removed, then it cannot be reset in the future?
Open the reportLowInaccurate Messages And ErrorsBaby Doge DEX · CertiK · 6 Oct 2022Fixed
```solidity require( _toBuyBackCoin0Percent <= 10000, "Has to be 10000" ); ``` The message should be "Has to be no more than 10000". --- Moreover, in L380 in contract `dexBuyBackFeeManager.sol`: ```solidity require(msg.sender == tx.origin, "Only Wallet"); ``` The message should be "Only EoA Wallet" or similar message because the wallet could be EoA or a wallet contract implementation.
Open the reportLowLack of Input ValidationBaby Doge DEX · CertiK · 6 Oct 2022Fixed
In the function `addLP()` and `replaceLP()`, `_pathTokenA` and `_pathTokenB` would be a path tokens that would be used in the AMM swap. However there's possibility that the `_pathTokenA` and `_pathTokenB` could be mistakenly inputted with same token calldata.
Open the reportLowRedundant ValidationBaby Doge DEX · CertiK · 6 Oct 2022Fixed
In the contract `dexTreasuryFeeManager` contract at the address of [0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8](https://bscscan.com/address/0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8#code), the if statement condition `instantSwapToStable == true` is redundant as the default value of `instantSwapToStable` is true and there's no other function to change its value.
Open the reportContracts2
| Address | Chain | Source code |
|---|---|---|
| 0xbda7c402f9de8ad737cedc3ab7cbfecd53f29c74 | Chain: BNB Chain | Source code: Verified source |
| 0x1b6878adfb16b949a8cef2fb28228afc84fcb6a8 | Chain: BNB Chain | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="baby-doge-2"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us