Inheritable Smart Contract Wallet

Summary

Delete only resets the element to its default value (e.g., address(0)) and does not reduce the array's length. This leaves gaps in the array, which can lead to inefficiencies and potential issues when iterating or relying on the array's length.

Vulnerability Details

• The vulnerability lies in the removeBeneficiary function:

• The delete keyword resets the element at indexToRemove to its default value but does not remove it from the array. This results in a gap (e.g., address(0)) in the beneficiaries array, and the array length remains unchanged.

Impact

• The array may contain invalid entries (address(0)), which can cause issues in logic that relies on the array's contents.

• The array length remains unchanged, leading to unnecessary storage usage and higher gas costs for operations involving the array.

• Potential Bugs: Iterating over the array or relying on its length for calculations may produce unexpected results.

Tools Used

• Manual code review

Recommendations

1. Replace the element to be removed with the last element in the array.

2. Use pop() to remove the last element and reduce the array's length.