Beincom security record
As of 30 Oct 2026, Beincom has 3 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 19 Mar 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Beincom - Audit 3 | Security firm: CertiK | Date: | Scope: Repository at commit 221ff14 | No open critical findings | Open · skynet.certik.com |
| Beincom - Audit 2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Beincom - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings28
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 4 | 0 |
| Medium | 0 | 2 | 3 |
| Low | 5 | 0 | 12 |
MediumBlocked Users Allowed to Receive TokensBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The `BicTokenPaymaster` contract includes a blocking feature designed to prevent blocked addresses from sending tokens. This is implemented through the `isBlocked` mapping and enforced in the `_validateBeforeTransfer` function: ```solidity=538 function _validateBeforeTransfer(address from) internal view { if (paused() || isBlocked[from]) { revert BICValidateBeforeTransfer(from); } } ``` However, this blocking mechanism does not prevent the blocked address from receiving tokens. This could result in tokens accumulating at a blocked address, potentially becoming stuck.
Open the reportMediumInconsistency Between Blocking and Fee ExclusionBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The `BicTokenPaymaster` contract allows addresses to be both blocked (`isBlocked`) from transferring tokens and excluded from fees (`isExcluded`). However, the current implementation does not prevent an address from being both blocked and fee-excluded simultaneously. In such a scenario, a blocked address can still transfer tokens without paying any fees, which undermines the intended restriction of blocking addresses.
Open the reportMediumPotential Zero `maxRewardStacks`Beincom - Audit 3 · CertiK · 19 Mar 2025Fixed
In the `BicVesting` contract, the calculation `maxRewardStacks = DENOMINATOR / redeemRateNumber` can result in `maxRewardStacks` being zero if `redeemRateNumber` exceeds `DENOMINATOR` (e.g., `redeemRateNumber > 10,000`). A zero value for `maxRewardStacks` leads to incorrect end time computations and can cause the vesting release functions to revert, preventing beneficiaries from claiming their tokens.
Open the reportLowEvent Not IndexedBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
If an event is not indexed in a smart contract, it means that the event's parameters are not tagged with the `indexed` keyword. This has implications for how the event data can be searched and filtered when looking through blockchain logs. Without indexing, the event will still emit the data as part of the transaction log, but users won't be able to query for these events using the parameters. They'll have to retrieve the entire set of logs and manually sift through them to find events with the specific data. This can be less efficient and more time-consuming, especially on a blockchain with a high volume of transactions and events.
Open the reportLowIncorrect Event ParametersBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
In `TokenSingletonPaymaster`, the event emitted by the function `setOracle()` use the new oracle address for the old oracle address and the new oracle address parameter: ```solidity function setOracle(address _oracle) external onlyOwner { oracle = _oracle; // oracle is now the same address as _oracle emit SetOracle(oracle, _oracle, msg.sender); // this is equivalent to SetOracle(_oracle, _oracle, ... } ```
Open the reportLowMissing Emit EventsBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowMissing Validation in `_setPrePublicRound()`Beincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The `_setPrePublicRound()` function allows setting `PrePublic` rounds without performing necessary validations on the provided parameters. Specifically: 1. There is no check to ensure `startTime` is less than `endTime`. This could result in invalid configurations where the round's start time is after its end time. 2. No validation is performed on other variables, such as `coolDown` or `maxAmountPerBuy`, which may lead to inconsistent or unexpected behavior. This lack of validation could result in the creation of invalid pre-public rounds, potentially leading to failures when users attempt to participate in the pre-public sale.
Open the reportLowRedundant ComparisonsBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
In `setLiquidityFee()`: ```solidity=200 require(min >= 0 && min <= max && max <= 5000, "B: invalid values"); ``` `min` being a `uint256`, it cannot be lower than zero, therefore `min >= 0` is always true. In `setLFReduction()`: ```solidity=212 if (_LFReduction <= 0) { ``` `_LFReduction` is a `uint256`, it cannot be lower than zero, therefore `_LFReduction <= 0` is equivalent to `_LFReduction == 0`
Open the reportLowUnnecessary Use of SafeMathBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The `BicTokenPaymaster` contract is utilizing Solidity version `^0.8.23` and OpenZeppelin Contracts version `v5`. Solidity `0.8.x` arithmetic operations include built-in overflow and underflow checks, eliminating the necessity for the `SafeMath` library. Additionally, OpenZeppelin Contracts version `v5` removed the `SafeMath` library. Despite these advancements, the protocol has manually integrated the `SafeMath` library, which is now redundant.
Open the reportLowUntitled findingBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
In `TokenSingletonPaymaster`'s constructor, `_singers` is supposed to be `_signers`.
Open the reportShow 5 more
LowUse of Manual Time Calculation Instead of Built-iBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The contract `BicTokenPaymaster` defines a time period as `LFPeriod = 60 * 60 * 24 * 30` to represent 30 days in seconds. While this approach works, Solidity provides built-in time units that allow developers to define durations more clearly and concisely. For instance, the same time period can be written as `30 days`, improving code readability and reducing potential errors from manual calculations.
Open the reportLowVesting End Time and Token Management IssuesBeincom - Audit 3 · CertiK · 19 Mar 2025Fixed
The contract's vesting logic has several issues related to the calculation of the vesting end time and the handling of token amounts: 1. **End Time Adjustment**: The vesting period's `end` time is adjusted when `DENOMINATOR % redeemRate > 0` by adding one `durationSeconds`. However, this adjustment can lead to incorrect final vesting periods or unused tokens. Specifically: - If `redeemRate` is not a divisor of `DENOMINATOR`, the last vesting period may allocate more tokens than intended or revert if the contract does not hold sufficient tokens. - If additional tokens are sent to the contract after initialization, they can be incorrectly distributed during the final vesting period. 2. **Over-allocation of Tokens**: When `block.timestamp == end`, the `_amountPerDuration` logic may still allocate tokens for another full period rather than only the remaining tokens. This can result in either: - More tokens than planned are distributed if the contract holds extra tokens. - The transaction fails if the contract does not hold enough tokens to meet the overestimated allocation.
Open the reportLowFunctions With `_` as Name Prefix Are Not `privatBeincom - Audit 2 · CertiK · 12 Sep 2024Fixed
Functions with names starting with `_` should be declared as `private`/`internal`.
Open the reportLowMissing Emit EventsBeincom - Audit · CertiK · 2 Aug 2024Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowValue of COST_OF_POSTBeincom - Audit · CertiK · 2 Aug 2024Fixed
The `COST_OF_POST` has a hard-coded value of 15000, and is used to compare with `userOp.verificationGasLimit` in line 113 as well as being used to calculate the amount of additional token charge in line 149. In the `_postOp()` function, the token `_transfer()` function is called, and its gas cost is not included in the `actualGasCost` and should be accounted for by the `COST_OF_POST`. However, the actual gas cost of the `BicTokenPaymaster`'s token transfer appears to be ~3 times higher than the hardcoded number, based on the hardhat gas report below. ```solidity Solc version: 0.8.23 · Optimizer enabled: true · Runs: 1000000 · Block limit: 30000000 gas │ | Methods │ ·························|··············|·············|·············|··········| | Contract · Method · Min · Max · Avg · | BicTokenPaymaster · transfer · 55475 · 60275 · 58675· ```
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="beincom"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us