Summary

The buyOutEstateNFT() function burns the NFT after a buyout instead of transferring it to the buyer. This results in the estate having no registered owner, even though the buyer has paid for it.

Vulnerability Details

Affected code:

• buyOutEstateNFT()

Example:

1. Assume an estate NFT is worth 100,000 USDC.

2. A beneficiary buys out the NFT, paying 66,666 USDC to other beneficiaries.

3. Instead of receiving ownership of the NFT, it is burned.

4. The buyer has no on-chain proof of ownership of the estate.

Impact

• The buyer does not receive the NFT, meaning their ownership is not recorded on-chain.

• The estate may become unrecoverable or lead to inconsistencies in tracking ownership.

• The intent of the buyout process is broken, as the estate should now belong to the buyer, not be removed from circulation

Tools Used

• Manual review

Recommendations

Instead of burning the NFT, transfer it to beneficiary (msg.sender), the rightful new owner.