Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing deadline reset can allow premature inheritance

iii

Summary

The inactivity period is reset by calls to InheritanceManager::_setDeadline in functions that the owner would use to interact with the wallet. However, such calls are missing in InheritanceManager::contractInteractions and InheritanceManager::createEstateNFT which would allow earlier inheritance than expected and breaks one of the core assumptions of the protocol:

EVERY transaction the owner does with this contract must reset the 90 days timer

Vulnerability Details

In functions InheritanceManager::createEstateNFT and more importantly InheritanceManager::contractInteractions there is no inactivity deadline reset. While it's important for both functions to register the owner interaction, the latter is the main way the owner would interact with other contracts using the smart wallet, so it's crucial those interactions reflect on the inactivity period.

Impact

Allows for premature inheritance by the beneficiaries and breaks a core invariant of the protocol

Proof of Concept

  1. Add a user as a beneficiary to initialize the deadline

  2. 90 days pass

  3. On the 90th day the owner calls createEstateNFT and contractInteractions but the deadline isn't reset

  4. One more day passes

  5. The beneficiary can inherit the contract even though the owner interacted with the wallet just one day ago

function test_missingDeadlineReset() public {
vm.prank(owner);
im.addBeneficiery(user1);
uint256 initialDeadline = im.getDeadline();
​
vm.warp(90 days);
​
vm.startPrank(owner);
im.createEstateNFT("dummy", 1, address(usdc));
im.contractInteractions(address(usdc), abi.encodeWithSignature("mint(address,uint256)", user1, 1), 0, false);
vm.stopPrank();
uint256 newDeadline = im.getDeadline();
assertEq(newDeadline, initialDeadline);
​
vm.warp(block.timestamp + 1);
​
vm.prank(user1);
im.inherit();
assertEq(im.getOwner(), user1);
}

Tools Used

Foundry

Recommendations

Add _setDeadline calls in both functions:

function contractInteractions(address _target, bytes calldata _payload, uint256 _value, bool _storeTarget)
external
nonReentrant
onlyOwner
{
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
interactions[_target] = data;
}
+ _setDeadline();
}
function createEstateNFT(string memory _description, uint256 _value, address _asset) external onlyOwner {
uint256 nftID = nft.createEstate(_description);
nftValue[nftID] = _value;
assetToPay = _asset;
+ _setDeadline();
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.