Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Uneven Fund Distribution Due to Integer Division Rounding in buyOutEstateNft and withdrawInheritedFunds function

sakamoto

Summary

The buyOutEstateNFT and** withdrawInheritedFunds** function in the InheritanceManager contract performs fund distribution using integer division. We know that division operations in solidity truncate decimal values instead of rounding them. This leads to an uneven distribution of funds, potentially causing some beneficiaries to receive less than their fair share and leaving an unallocated remainder in the contract.

Vulnerability Details

The amountPerBeneficiary variable in the withdrawInheritedFunds function calculates the amount to be distributed among each beneficiaries, using division operations.

function withdrawInheritedFunds(address _asset) external {
....
uint256 divisor = beneficiaries.length;
if (_asset == address(0)) {
uint256 ethAmountAvailable = address(this).balance;
uint256 amountPerBeneficiary = ethAmountAvailable / divisor; //Uneven fund distribution
for (uint256 i = 0; i < divisor; i++) {
....
}
} else {
uint256 assetAmountAvailable = IERC20(_asset).balanceOf(address(this));
uint256 amountPerBeneficiary = assetAmountAvailable / divisor; //Uneven fund distribution
for (uint256 i = 0; i < divisor; i++) {
IERC20(_asset).safeTransfer(beneficiaries[i], amountPerBeneficiary);
}
}
}

The finalAmount variable in the buyOutEstateNFT function calculates the total amount to be distributed among the beneficiaries, excluding the msg.sender, using division operations.

function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
=> uint256 finalAmount = (value / divisor) * multiplier; //Uneven fund distribution
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount);
....
nft.burnEstate(_nftID);
}

An example of the issue-

Total Nft buyout value = 100

Number of beneficiaries = 3

Divisor (beneficiaries.length) = 3

Multiplier (beneficiaries.length -1) = 2

Final Amount Calculation: finalAmount = (100 / 3) 2 = 33 * 2 = 66 (Truncated)

Each Remaining Beneficiary Gets: 66 / 3 = 22 (instead of 22.5)

Impact

Some beneficiaries may receive slightly less than their expected amount, leading to financial discrepancies.

Tools Used

Manual Review

Recommendations

Use a proportional adjustment strategy.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has wrong denominator

truncation of integers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.