Bean Eco Smart Chain

CertiKFiles named in the report

CertiK reviewed BESC LLC (Bean Eco Smart Chain) on 7 Apr 2023: 11 findings, 0 critical; 1 marked fixed, 10 open.

No open critical findings
Open the reportOpen BESC LLC’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low1001
LowDiscussion on the `reward` functionOpen

In the `reward()` function, the rewards for delegators are calculated based on the shares they have delegated to a validator's stake. However, the resulting reward calculation is only emitted as an event and returned as values, but not transferred to the intended addresses. We would like to know more about the mechanism for invoking the `reward()` function in each block, how the return values are utilized to transfer the rewards to the delegators' addresses, and how the `rewards[0]` is distributed.

LowFixed `SYSTEM_ADDRESS`Open

The `SYSTEM_ADDRESS` is a critical address yet is set to `0xffffFFFfFFffffffffffffffFfFFFfffFFFfFFfE` and cannot be altered once set. It plays a vital role as the only address authorized to invoke the `reward()` function, hence it is crucial to set it carefully during the initial contract deployment.

LowInternal `_setSnapshot()`Open

The function `_setSnapshot()` is internal and not called in any contracts.

LowLogical issue on the `_withdraw()`Open

Within the `withdraw()` function, if a staker seeks to withdraw the stake from a current validator and meets the condition `stakeAmount(_validator).sub(_amount) < getMinStake()`, the current validator will be removed from the pending validator list, even though no ethers have been withdrawn to the staker.

LowMissing Error MessagesOpen

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

LowNot used `requiredSignatures`()Open

The `requiredSignatures()` returns `currentValidatorsLength().div(2).add(1)`, but the number is not used anywhere in the contracts.

LowRedundant `delete` OperationOpen

The [offical solidity website](https://docs.soliditylang.org/en/v0.6.12/types.html#delete) writes that: > delete a[x] deletes the item at index x of the array and leaves all other elements and the length of the array untouched. Hence the length of `_addresses[]` would not be reduced after the delete operation, however, the `len` would reduce 1 anyway, which makes the `delete _addresses[len - 1];` redundant.

LowRedundant Code ComponentsOpen

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

LowUser-Defined GettersOpen

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

LowWeak pseudo random number generatorOpen

The `random` number generation is based on the result of `keccak256(abi.encodePacked(blockhash(block.number - 1)))` encryption of `block.number` that is easy to control or get.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (12)

  • besc-network/contracts/eternal-storage/EternalStorageProxy.sol
  • besc-network/contracts/ProxyStorage.sol
  • besc-network/contracts/eternal-storage/EternalStorage.sol
  • besc-network/contracts/ConsensusUtils.sol
  • besc-network/contracts/Voting.sol
  • besc-network/contracts/Consensus.sol
  • besc-network/contracts/abstracts/VotingBase.sol
  • besc-network/contracts/BlockReward.sol
  • besc-network/contracts/abstracts/BlockRewardBase.sol
  • besc-network/contracts/Migrations.sol
  • besc-network/contracts/VotingUtils.sol
  • besc-network/contracts/abstracts/ValidatorSet.sol

Part of BESC LLC’s security record

BESC LLC
Audits1 audit by 1 firmLast audit Apr 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open BESC LLC’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us