BESC LLC security record

In the `reward()` function, the rewards for delegators are calculated based on the shares they have delegated to a validator's stake. However, the resulting reward calculation is only emitted as an event and returned as values, but not transferred to the intended addresses. We would like to know more about the mechanism for invoking the `reward()` function in each block, how the return values are utilized to transfer the rewards to the delegators' addresses, and how the `rewards[0]` is distributed.

The `SYSTEM_ADDRESS` is a critical address yet is set to `0xffffFFFfFFffffffffffffffFfFFFfffFFFfFFfE` and cannot be altered once set. It plays a vital role as the only address authorized to invoke the `reward()` function, hence it is crucial to set it carefully during the initial contract deployment.

The function `_setSnapshot()` is internal and not called in any contracts.

Within the `withdraw()` function, if a staker seeks to withdraw the stake from a current validator and meets the condition `stakeAmount(_validator).sub(_amount) < getMinStake()`, the current validator will be removed from the pending validator list, even though no ethers have been withdrawn to the staker.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

The `requiredSignatures()` returns `currentValidatorsLength().div(2).add(1)`, but the number is not used anywhere in the contracts.

The [offical solidity website](https://docs.soliditylang.org/en/v0.6.12/types.html#delete) writes that: > delete a[x] deletes the item at index x of the array and leaves all other elements and the length of the array untouched. Hence the length of `_addresses[]` would not be reduced after the delete operation, however, the `len` would reduce 1 anyway, which makes the `delete _addresses[len - 1];` redundant.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

The `random` number generation is based on the result of `keccak256(abi.encodePacked(blockhash(block.number - 1)))` encryption of `block.number` that is easy to control or get.