CertiK reviewed Bequest (Bequest Finance) on 10 Mar 2023: 8 findings, 0 critical; 5 marked fixed, 3 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 3 | 2 |
A user may avoid the renewal fee by calling `renewBequest()` function at least once every year. In function `getRenewalFee()`, if the bequester has never paid the renewal fee before, the `timePassed` will be calculated from the `addressToBequest[_owner].timestamp`, and the `yearsPassed` would refer to the number of years between now and the last renewal time. In function `renewBequest()`, if the `yearsPassed` is 0, no yearly fee would be collected. Meanwhile, the `addressToBequest.timestamp` would still be updated to the current time. This would mean that, if the bequester keeps renewing bequest within a year, he won't be charged of any renewal fees.
The ETH balance in the contract consists of referral profit intended for the profit addresses, and fees that can be withdrawn by contract owner. While the profit for each referral is recorded, function `extractFees()` does not have an upper limit. If the contract owner extracts too much ETH from the contract, profit addresses won't be able to withdraw any profit.
When the `distribution()` function is called for a bequest for the first time, 1% of the wallet's balance is collected as fee, and the `paidDistributionFee[owner]` is set to *true*. If the bequest owner renews the bequest via function `renewBequest()` after that, the `paidDistributionFee` is not reset to *false*, so the distribution fee won't be collected for the renewed bequest. This makes it possible for a user to bypass the distribution fees.
The function that affects the status of sensitive variables should be able to emit events as notifications to users. - `renewBequest()` - `createReferral()` - `setYearlyFee()`
When distributing the ERC20 token, the total amount of token to distribute is decided by the token balance of the bequest owner and the allowance for this contract, according to function `safeSendERC20s()`. Since function `distribute()` gives out the shares to one beneficiary at one call, it is possible for the bequest owner to change the allowance to this contract between recipient claims. The same applies for ERC721 and ERC1155. The ownership of the NFT or owned amount of ERC1155 may change outside of this contract after the bequest becomes claimable. The beneficiary is not guaranteed to receive the tokens intended for them initially.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us