Submission Details
Severity:
In `InheritableManager.sol` `_getBeneficiaryIndex` will return the 0 index for addresses that aren't in the `beneficiaries` array, causing the wrong address to be removed when `removeBeneficiary` is called
Summary
In InheritableManager.sol _getBeneficiaryIndex will always return the 0 index for addresses that aren't in the beneficiaries array, causing the wrong address to be removed when removeBeneficiary is called
Vulnerability Details
The issue is here:
function _getBeneficiaryIndex(address _beneficiary) public view returns (uint256 _index) {
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (_beneficiary == beneficiaries[i]) {
_index = i;
break;
}
}
}
There's no functionality that handles the situation where the address is not in the `beneficiaries` array, as such the default uint256 value would be returned i.e 0
POC
Add the below test to `InheritableManagerTest.t.sol`
function testWrongIndexDeleted() public {
address zeroIndex = makeAddr("zeroIndex");
address firstIndex = makeAddr("firstIndex");
address rando = makeAddr("rando");
vm.startPrank(owner);
im.addBeneficiery(zeroIndex);
im.addBeneficiery(firstIndex);
//check that the stored address at the zero index matches
assertEq(zeroIndex, im.beneficiaries(0)); //function made public for ease of access
//remove the address thats not beneficiary
im.removeBeneficiary(rando);
vm.stopPrank();
//zero index position gets replaced with address(0)
address newZeroindex = im.beneficiaries(0);
assertEq(newZeroindex, address(0));
}
Impact
The beneficiary at the 0th index would be removed unfairly
Tools Used
Manual review, foundry test suite
Recommendations
function _getBeneficiaryIndex(address _beneficiary) public view returns (uint256 _index) {
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (_beneficiary == beneficiaries[i]) {
_index = i;
+ return _index;
- break;
}
}
+ revert("Address is not beneficiary");
}
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.