Bequest security record

A user may avoid the renewal fee by calling `renewBequest()` function at least once every year. In function `getRenewalFee()`, if the bequester has never paid the renewal fee before, the `timePassed` will be calculated from the `addressToBequest[_owner].timestamp`, and the `yearsPassed` would refer to the number of years between now and the last renewal time. In function `renewBequest()`, if the `yearsPassed` is 0, no yearly fee would be collected. Meanwhile, the `addressToBequest.timestamp` would still be updated to the current time. This would mean that, if the bequester keeps renewing bequest within a year, he won't be charged of any renewal fees.

The ETH balance in the contract consists of referral profit intended for the profit addresses, and fees that can be withdrawn by contract owner. While the profit for each referral is recorded, function `extractFees()` does not have an upper limit. If the contract owner extracts too much ETH from the contract, profit addresses won't be able to withdraw any profit.

When the `distribution()` function is called for a bequest for the first time, 1% of the wallet's balance is collected as fee, and the `paidDistributionFee[owner]` is set to *true*. If the bequest owner renews the bequest via function `renewBequest()` after that, the `paidDistributionFee` is not reset to *false*, so the distribution fee won't be collected for the renewed bequest. This makes it possible for a user to bypass the distribution fees.

The function `claim()` is called to retrieve the assets in the contract for the recipient. The 94 lines of code stipulate that if the user doesn’t buy a will from the bequestWillContract `or` assets that can be claimed, the `require` function will pass. ```solidity=93 // Ensures assets cannot be claimed before a Bequest will is claimable, will never revert require(!bequestWillContract.isOwner(owner) || bequestWillContract.isClaimable(owner), "Not claimable"); ```

The function that affects the status of sensitive variables should be able to emit events as notifications to users. - `renewBequest()` - `createReferral()` - `setYearlyFee()`

When distributing the ERC20 token, the total amount of token to distribute is decided by the token balance of the bequest owner and the allowance for this contract, according to function `safeSendERC20s()`. Since function `distribute()` gives out the shares to one beneficiary at one call, it is possible for the bequest owner to change the allowance to this contract between recipient claims. The same applies for ERC721 and ERC1155. The ownership of the NFT or owned amount of ERC1155 may change outside of this contract after the bequest becomes claimable. The beneficiary is not guaranteed to receive the tokens intended for them initially.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=54 owner = _owner; ``` - `_owner` is not zero-checked before being used. --- ```solidity=55 recipient = _recipient; ``` - `_recipient` is not zero-checked before being used. --- ```solidity=21 implContract = _impl; ``` ```solidity=22 (bool success, ) = _impl.delegatecall( abi.encodeWithSignature( "setup(address,address,uint256,uint256,uint256)", _owner, _recipient, _lockedUntil, _yearsToVest, _vestedUntil ) ); ``` - `_impl` is not zero-checked before being used.