Inheritable Smart Contract Wallet

Summary

The withdrawInheritedFunds function in your contract is vulnerable to a reentrancy attack because it transfers ETH using .call, allowing recipients to execute code before the transaction is fully completed.
If a beneficiary is a malicious contract, it can repeatedly re-enter the function and withdraw more funds than intended before the contract updates its balance.

Vulnerability Details

• The function sends ETH to multiple beneficiaries using .call{value: amountPerBeneficiary}(""), which allows external contracts to execute their own logic upon receiving funds.

• If a malicious contract is one of the beneficiaries, it can re-enter the function before it completes execution and trigger additional withdrawals.

• This could drain all funds in the contract before other beneficiaries receive their share.

Impact

The attacker can drain all ETH in the contract by continuously re-entering before balances update.

Tools Used

Manual review and slither

Recommendations

Use OpenZeppelin’s ReentrancyGuard to prevent issue :