BitDCA is a protocol that enables automatic small savings when making card payments. The Staking Contract is a subcomponent of BitDCA that allows users to stake BDCA tokens and receive rewards.
The protocol implements a staking system with NFT-based positions and tiered rewards. This allows users to lock up their BDCA tokens for a predefined period of time in exchange for bonuses. USDT and BDCA also have additional bonus distribution options during the staking period.
BitDCA collaborated with Ackee Blockchain Security to conduct a security review of the BitDCA staking contract with a total time contribution of 6 engineering days between June 23 and July 3, 2025.
The second revision review was conducted between August 14 and August 15, 2025.
A third revision review was conducted through a one-day engineering time donation to address any issues not addressed in previous revisions.
methodology
- Technical specifications verification
The scope of the audit is confirmed with the client and the auditor joins the project. Review the provided documentation and compare it to your audit system. - Tool-based analysis
In-depth scanning using the Solidity static analysis tool Wake, along with the Solidity (Wake) extension, is performed to flag potential vulnerabilities for further analysis early in the process. - Manual code review
Auditors manually check code line by line to identify vulnerabilities and code quality issues. The main focus is recognizing potential edge cases and project-specific risks. - Local deployment and hacking
The contract is deployed to the local Wake environment where targeted attempts to exploit the vulnerability are made. The resilience of the contract against various attack vectors is assessed. - Unit and fuzzy testing
Unit tests are run to verify expected system behavior. Once coverage gaps are identified, you can use the Wake Framework to write additional unit or fuzz tests. The goal is to verify the stability of the system under real-world conditions and ensure robustness to expected and unexpected inputs.
We began our review using static analysis tools, including Wake. We then took a closer look at the logic of the contract. Used Wake Framework for testing and fuzzing. The staking contract has been integrated with the out-of-scope contract (Presale.sol) has been black-boxed for review purposes. During the review process, we paid special attention to the following:
- Verify that the system’s calculations are correct.
- Verify the fairness of reward distribution.
- Verify that the staking process matches expected behavior.
- Detect possible reentrancy in your code.
- Ensure access controls are neither too lax nor too strict. and
- I’m looking for common problems like data validation.
range
An audit was performed at commit time. c62d3dd It’s in a private repository and has the following scope:
Staking.sol; andStakingNFT.sol
Revision 1.1 was performed on commits between August 14 and August 15, 2025. 522ad96The scope is a revision of the previous revision.
Revision 2.0 was done on commit. c05674cScope is an issue unresolved in previous revisions.
The classification of security findings is determined by two levels: influence and something that could happen. This two-dimensional classification helps clarify the severity of individual problems. Problems that can be assessed as: middle Severity can only be discovered by the team, but is usually reduced by the likelihood factor. femaleAnning or meinformation provided Severity rating.
Here are the results of our review: 25 items foundSeverity levels range from Warning to High. The most serious findings include: H2The distribution of rewards may be incorrect. Full details by revision can be found in the Audit Report PDF linked below.
critical severity
No critical severity issues were found.
Severity High
H1: Inverted logic of NFT transfer hook
H2: distributeRewards The function is defective
H3: Project is not compatible with Smart Accounts
medium severity
M1: Hardcoded minority assumption
M2: You can bypass stake amount limits.
low severity
L1: Insecure ERC20 operations
L2: Inconsistent access control
L3: The maximum stake amount may be exceeded.
L4: Missing events for important state changes
L5: Missing pause modifier when distributing rewards.
L6: The mint function is performing a safe mint.
warning severity
W1: Affiliate Program Integration
W2: Insufficient data validation
W3: Possible lack of funds
W4: Potential re-entry due to NFT hook
W5: Uninitialized variables and roles
W6: Unknown swap condition
W7: Potential price manipulation of reward distribution
Information Severity
I1: Code replication
I2: Divide by 0 in reward calculations
I3: Ambiguous error message
I4: Use magic number
I5: Missing document
I6: Typo
I7: Unused variable
trust model
Administrators have excessive power across all contracts, creating a potential single point of failure. Administrators can change important parameters, pause/unpause as desired, modify layer parameters affecting user funds, and withdraw all tokens at any time by: rescueToken function. Contracts may also be upgraded to other implementations.
conclusion
Ackee Blockchain Security recommended BitDCA:
- Write documentation for your code base.
- We use an oracle for price calculation during reward distribution.
- Define specifications for the distribution function and adjust the logic accordingly.
- Create a comprehensive test suite.
- Simulate deployment transactions before executing them. and
- Address any identified issues.
Ackee Blockchain Security’s full BitDCA staking contract audit report can be found here.
We were delighted to audit BitDCA and look forward to working with them again.