Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `InheritanceManager::deadline` update in some critical functions will lead to loss of funds

olayinkablexxy

Summary

Several critical functions in the InheritanceManager contract do not call InheritanceManager::setDeadline to update the inactivity period. These functions include: InheritanceManager::contractInteractions, InheritanceManager::createEstateNFT and InheritanceManager::removeBeneficiary.

Vulnerability Details

The deadline is intended to be reset every time the owner performs an action, ensuring that beneficiaries cannot inherit the contract unless the owner has been inactive for 90 days. However, the absence of InheritanceManager::setDeadline in these functions means that the inactivity period is not properly enforced, potentially allowing beneficiaries to inherit the contract earlier than intended.

POC

Place the following test in the test/InheritanceManagerTest.t.sol file:

function test_premature_takeover() external {
address user2 = makeAddr("user2");
​
vm.startPrank(owner);
im.addBeneficiery(user1);
im.addBeneficiery(user2);
vm.stopPrank();
​
uint256 deadlineBefore = im.getDeadline();
​
vm.warp(deadlineBefore + 90 days + 1 seconds);
​
vm.startPrank(owner);
im.removeBeneficiary(user2); // any of the aforementioned functions can be called here
vm.stopPrank();
​
assertFalse(im.getIsInherited());
​
uint256 deadlineAfter = im.getDeadline();
​
// Deadline after should be more, but it's not
assertEq(deadlineAfter, deadlineBefore);
​
// user1 who is a beneficiary can now inherit, even though they shouldn't
vm.prank(user1);
im.inherit();
​
assertTrue(im.getIsInherited());
}

Impact

Beneficiaries can inherit the contract prematurely and withdraw all funds before the inactivity period has elapsed.

Tools Used

  • Manual Review

  • Foundry

Recommendations

Ensure that InheritanceManager::_setDeadline is called in all functions where owner activity is expected (all the functions mentioned in the summary).

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.