Submission Details
Severity:
Delete keyword will cause inheritable funds to be burnt in `InheritableManager.sol`
Summary
The removeBeneficiary function in InheritableManager.sol enables the owner to remove an added beneficiary. But to do so, it uses the delete keyword on the target index. This will cause parts of the beneficiaries array to be populated with address(0), meaning that when the funds get distributed a part of it will be effectively burnt.
Vulnerability Details
The issue occurs here:
function removeBeneficiary(address _beneficiary) external onlyOwner {
uint256 indexToRemove = _getBeneficiaryIndex(_beneficiary);
@> delete beneficiaries[indexToRemove];
}
POC
function testUsingDeleteKeywordIsBad() public {
address zeroIndex = makeAddr("zeroIndex");
address firstIndex = makeAddr("firstIndex");
address secondIndex = makeAddr("secondIndex");
vm.startPrank(owner);
im.addBeneficiery(zeroIndex);
im.addBeneficiery(firstIndex);
im.addBeneficiery(secondIndex);
//check that the stored address at the first index matches
assertEq(firstIndex, im.beneficiaries(1));
//remove the beneficiary
im.removeBeneficiary(firstIndex);
vm.stopPrank();
//first index position gets replaced with address(0)
address newFirstindex = im.beneficiaries(1); //function made public for ease of access
assertEq(newFirstindex, address(0));
}
Impact
Beneficiaries will lose their funds
Tools Used
manual review, foundry test suite
Recommendations
function removeBeneficiary(address _beneficiary) external onlyOwner {
uint256 indexToRemove = _getBeneficiaryIndex(_beneficiary);
- delete beneficiaries[indexToRemove];
+ beneficiaries[indexToRemove] = beneficiaries[beneficiaries.length - 1];
+ beneficiaries.pop();
}
Updates
Lead Judging Commences
0xtimefliez 9 months ago
Submission Judgement Published Assigned finding tags:
Incorrect removal from beneficiary list causes funds to be send to 0 address
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.