All dAppsCampaignRed AlarmDiscover
tinyblock

TinyBlock

High Risk

Fuel your Launch. Fund your Future

View dApp DetailsClaim your service's safety
1 Issues Detected
1

Backdoor Functions

0x103d077625e00380e67ea543ae243958f39c4b6e:TinyIDO.withdrawNative(address,uint256) {TinyIDO.sol#57-59} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyIDO.sol#58}
Modifiers: onlyOwner
TinyIDO.commit(uint256,uint256,address,uint256,uint256,uint256,uint256,uint256,bytes) {TinyIDO.sol#65-100} has backdoor transfer function that is able to drain all funds in the contract:
- address(TREASURY).transfer(_amount) {TinyIDO.sol#94}
Modifiers: nonReentrant,whenNotPaused
However, since the contract is not stake-able, the risk is lowered.
0x3d40f683d7abc7380c164d0bcb960c96745ec62c:TinyVesting.withdrawNative(address,uint256) {TinyVesting.sol#134-137} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyVesting.sol#136}
Modifiers: onlyOwner
However, the following expressions might block the token from being drained:
- require(bool,string)(_to != address(0),_to is zero address) prevents token unknown (ref: 0) [balance: N/A] to be drained.
TinyVesting.partialRefund(uint256,uint256,address,uint256,uint256,uint256,bytes) {TinyVesting.sol#192-230} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#223}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#226}
Modifiers: nonReentrant
TinyVesting.refund(uint256,uint256,address,uint256,uint256,uint256,bytes) {TinyVesting.sol#232-270} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#263}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#266}
Modifiers: nonReentrant
TinyVesting.crf(uint256,uint256,address,uint256,uint256,bytes) {TinyVesting.sol#272-305} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#298}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#301}
Modifiers: nonReentrant
TinyVesting.bonus(uint256,uint256,address,uint256,uint256,bytes) {TinyVesting.sol#308-342} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#335}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#338}
Modifiers: nonReentrant
However, since the contract is not stake-able, the risk is lowered.
0x734c8aeb813aad647215dcd577f3a02b6aad88f6:TinyIDO.withdrawNative(address,uint256) {TinyIDO.sol#57-59} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyIDO.sol#58}
Modifiers: onlyOwner
TinyIDO.commit(uint256,uint256,address,uint256,uint256,uint256,uint256,uint256,bytes) {TinyIDO.sol#65-100} has backdoor transfer function that is able to drain all funds in the contract:
- address(TREASURY).transfer(_amount) {TinyIDO.sol#94}
Modifiers: nonReentrant,whenNotPaused
However, since the contract is not stake-able, the risk is lowered.

Recent Listed Risky dApps

AIME

High Risk

Xnect

High Risk

Altura

High Risk

Blockchain Superheroes

High Risk

KaBoom

High Risk

CrossSpace

High Risk

MobyDEX

High Risk

Anima

High Risk
Summary
High Risk
Audit
DappBay Red Alarm
List Time
Jun, 27, 2025
Chain
BNB Smart Chain

Provides top decentralized apps (dApps) on BNB Smart Chain, opBNB and Greenfield.

dApps

Explore all dApps New Listings Top DeFi Protocols Top Blockchain Games Top NFT Projects Top Social dApps Top Infra and Tools
© 2025 BNB Chain. All rights reserved.