Bequest Finance

CertiKFiles named in the report

CertiK reviewed Bequest (Bequest Finance) on 10 Mar 2023: 8 findings, 0 critical; 5 marked fixed, 3 acknowledged.

No open critical findings
Open the reportOpen Bequest’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium003
Low032
MediumBequester May Avoid Renewal Fee by Constantly RenFixed

A user may avoid the renewal fee by calling `renewBequest()` function at least once every year. In function `getRenewalFee()`, if the bequester has never paid the renewal fee before, the `timePassed` will be calculated from the `addressToBequest[_owner].timestamp`, and the `yearsPassed` would refer to the number of years between now and the last renewal time. In function `renewBequest()`, if the `yearsPassed` is 0, no yearly fee would be collected. Meanwhile, the `addressToBequest.timestamp` would still be updated to the current time. This would mean that, if the bequester keeps renewing bequest within a year, he won't be charged of any renewal fees.

MediumLack of Upper Limit for Fee ExtractionFixed

The ETH balance in the contract consists of referral profit intended for the profit addresses, and fees that can be withdrawn by contract owner. While the profit for each referral is recorded, function `extractFees()` does not have an upper limit. If the contract owner extracts too much ETH from the contract, profit addresses won't be able to withdraw any profit.

MediumPossibility to Bypass Distribution Fee after ReneFixed

When the `distribution()` function is called for a bequest for the first time, 1% of the wallet's balance is collected as fee, and the `paidDistributionFee[owner]` is set to *true*. If the bequest owner renews the bequest via function `renewBequest()` after that, the `paidDistributionFee` is not reset to *false*, so the distribution fee won't be collected for the renewed bequest. This makes it possible for a user to bypass the distribution fees.

LowMissing Emit EventsFixed

The function that affects the status of sensitive variables should be able to emit events as notifications to users. - `renewBequest()` - `createReferral()` - `setYearlyFee()`

LowPossibility to Change Allowance after Wait PeriodFixed

When distributing the ERC20 token, the total amount of token to distribute is decided by the token balance of the bequest owner and the allowance for this contract, according to function `safeSendERC20s()`. Since function `distribute()` gives out the shares to one beneficiary at one call, it is possible for the bequest owner to change the allowance to this contract between recipient claims. The same applies for ERC721 and ERC1155. The ownership of the NFT or owned amount of ERC1155 may change outside of this contract after the bequest becomes claimable. The beneficiary is not guaranteed to receive the tokens intended for them initially.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • BequestWillV1.sol

Part of Bequest’s security record

Bequest
Audits2 audits by 1 firmLast audit Mar 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open Bequest’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us