Inheritable Smart Contract Wallet

Summary

When using the removeBeneficiary() function, a new deadline does not get set, breaking the invariant that EVERY transaction the owner does using the contract is supposed to update the deadline (in order to show the owner is still active).

Vulnerability Details

Within the removeBeneficiary() function, the internal _setDeadline() function is not called as it is within the addBeneficiary() function. This causes the deadline to not update after removing a beneficiary.

Impact

The deadline is not updated in accordance with a key invariant used within this system. This could allow the inherit() function to be called earlier than anticipated, changing the isInherited state to be True and allow for funds to be withdrawn by those beneficiaries.

Tools Used

Manual review and Foundry

Recommendations

Include the _setDeadline() function at the end of the removeBeneficiary() function to cause the deadline to be reset upon each successful removal of a beneficiary.