Bequest Finance (Audit #2)

CertiK8 Feb 2023Files named in the report

Audit

CertiK reviewed Bequest (Bequest Finance (Audit #2)) on 8 Feb 2023: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Bequest’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	1

MediumThe user does not buy the will and the recipientFixed

The function `claim()` is called to retrieve the assets in the contract for the recipient. The 94 lines of code stipulate that if the user doesn’t buy a will from the bequestWillContract `or` assets that can be claimed, the `require` function will pass. ```solidity=93 // Ensures assets cannot be claimed before a Bequest will is claimable, will never revert require(!bequestWillContract.isOwner(owner) || bequestWillContract.isClaimable(owner), "Not claimable"); ```

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=54 owner = _owner; ``` - `_owner` is not zero-checked before being used. --- ```solidity=55 recipient = _recipient; ``` - `_recipient` is not zero-checked before being used. --- ```solidity=21 implContract = _impl; ``` ```solidity=22 (bool success, ) = _impl.delegatecall( abi.encodeWithSignature( "setup(address,address,uint256,uint256,uint256)", _owner, _recipient, _lockedUntil, _yearsToVest, _vestedUntil ) ); ``` - `_impl` is not zero-checked before being used.