Loading...
Loading...
Last updated: September 10, 2026
The BSCLaunch contracts are deployed on the Sepolia testnet and have completed an internal security review and an extensive automated test campaign. The review was carried out in-house rather than by an outside audit firm, and is published in full so you can read exactly what was found and fixed.
Examples of what the review fixed
Each sale is a minimal-proxy clone of this implementation
This list is generated from the deployment records in the repository, so it always matches what is actually on chain. Mainnet addresses will appear here after the audit, and every contract is verified on its block explorer.
After a sale ends anyone can finalize it. If the soft cap is missed, or the project has not deposited the tokens it sold within 14 days, every contributor withdraws their full contribution. Refunds are never pausable.
A project is paid only once every token it sold is already in the sale contract.
If the project or treasury wallet cannot receive its share, the amount is parked inside the sale contract for later withdrawal and contributors still claim on schedule.
The 2% fee (max 5%) is set by the platform, not the project, and can no longer be changed once a sale opens — the fee you see when you contribute is the fee that applies.
Every value-moving function is guarded and updates state before transferring; BNB payouts use call so multisig recipients work.
All contracts use Ownable2Step, so control only moves to an address that explicitly accepts it, and renouncing ownership is disabled — a sale can never be left with nobody able to deliver its tokens. Contracts will be handed to a multisig before mainnet.
Price, caps, dates and vesting are written once when the sale is created and there is no function to change them afterwards.
Staked BSL can be unstaked even while the staking contract is paused; unpaid rewards are remembered, never forfeited.
If a project turns out to be fraudulent or its terms are wrong, the platform can cancel a live sale. Cancelling does not release the money to anyone — it opens the refund path, and every contributor withdraws their full contribution.
If a project goes silent after a successful sale and never sets the unlock date, anyone can set it 180 days after finalization, and claiming begins immediately.
Contracts, tests and the full internal review are published in the repository.
Launches together with mainnet
A funded, public bug bounty will be announced with the mainnet deployment. Until then, testnet findings are very welcome through the disclosure process below and will be credited.
To report a security vulnerability:
Security: security@bsclaunch.io
PGP Key: Available on request
Tests on every change
The Foundry suite runs before any contract change is merged
Review before each deployment
Every deployment is followed by an on-chain smoke test
Incident response
Pause, communicate, fix, publish a post-incident report
Public review document
Findings and fixes are published, not summarised into a score