Inheritable Smart Contract Wallet

Summary

The contract InheritanceManager.sol fails to reset the 90-day inactivity timer in certain owner actions, specifically in contractInteractions(), createEstateNFT() and removeBeneficiary(). This violates the protocol's core invariant that every owner transaction must reset the timer and allows not only beneficiaries but even attackers to inherit the contract.

Vulnerability Details

Affected code:

• inherit()

• contractInteractions()

• createEstateNFT()

• removeBeneficiary()

The contract assumes that every interaction by the owner resets the inactivity timer to 90 days. However, three functions - contractInteractions(), createEstateNFT() and removeBeneficiary() in InheritanceManager.sol do not call _setDeadline(). As a result, these interactions do not extend the inheritance deadline, potentially leading to unintended inheritance activation despite ongoing owner activity. Furthermore, an active owner could interact with the contract but still lose ownership due to inheritance being triggered.

Impact

• Even if the owner is actively using the contract, missing _setDeadline() calls could cause the contract to assume inactivity and allow beneficiaries to inherit funds.

• If the contract has only one beneficiary (the owner's backup wallet) then it is even worse because the owner can lose ownership of the contract due to this block in the inherit() function:

  if (beneficiaries.length == 1) {

  owner = msg.sender;

  _setDeadline();

  }

• Breaking a core invariant - the system is designed to ensure that any owner interaction resets the timer. This issue breaks that assumption, introducing unintended behavior.

Tools Used

• Manual review

Recommendations

To keep the protocol's invariant => "EVERY transaction the owner does with this contract must reset the 90 days timer" and maintain the protocol’s expected behavior, add _setDeadline(); at the end of the affected functions:

By implementing this fix, the contract will correctly reset the 90-day timer for all owner interactions, preserving the intended functionality and preventing unintended inheritance.