Smart Contract
Security Audit
Comprehensive security review of all BuyNow Finance smart contracts deployed on Base mainnet. 1305 lines of Solidity analyzed across 5 contracts.
0
Critical Issues
2
High (By Design)
4
Medium
1305
Lines Reviewed
Audit Information
| Audit Date | March 2026 |
| Auditor | Grey Zone Security Review Team |
| Scope | 5 Solidity Contracts (1305 lines) |
| Compiler | Solidity ^0.8.20 |
| Framework | OpenZeppelin Contracts Upgradeable |
| Network | Base Mainnet (Chain ID 8453) |
| Upgrade Pattern | UUPS Proxy |
Contracts Reviewed
Core BNPL marketplace — order creation, buying, installment payments, defaults
Protocol treasury — fee collection, fund distribution, spending limits
Governance — token staking, proposal creation, voting
ERC20 governance token — minting, vesting, burn, pause
Merkle-based airdrop — epoch management, usage & referral claims
Methodology
Findings Summary
Detailed Findings(15 total)
Overall Assessment
The BuyNow Finance smart contract suite demonstrates solid engineering practices. All contracts use OpenZeppelin's battle-tested libraries for upgradeability, access control, reentrancy protection, and safe token transfers. The code is well-structured, properly documented, and follows established Solidity patterns.
The two HIGH severity findings are inherent to the protocol's design (unsecured BNPL lending) rather than implementation bugs. The MEDIUM findings relate to accounting precision and governance timing, which should be addressed in future upgrades. The LOW findings are quality-of-life improvements for transparency and parameter safety.
No critical vulnerabilities were found. The contracts are suitable for mainnet deployment with the understanding that the BNPL model carries inherent credit risk by design.
Verified Contract Addresses
| Contract | Address | Explorer |
|---|---|---|
| BNPLMarket | 0xeF512b33a53aB93E096b74e4f2D7dC4cB2F283e4 | BaseScan |
| BNPLTreasury | 0x32Dd4172A3d5C59572a8655923b375b1900E62b0 | BaseScan |
| BNPLGovernance | 0x8D83E25dDc892E072c884Bc65Ccfb8d40a15863f | BaseScan |
| BNPLToken | 0xB13a1dD4BA2Cb06F22dba6061b779dD8B1FCa39f | BaseScan |
| BNPLAirdrop | 0xFE9Ca7aE0948d16Ac27C90BEf2ef2a9a6167Eaa3 | BaseScan |
This security review was conducted by the Grey Zone Security Review Team in March 2026. It covers the Solidity source code of all 5 core contracts (1305 lines total). This review does not constitute a guarantee of security. Users should exercise their own judgment when interacting with any smart contract.