Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-4] InheritanceManager::nonReentrant modifier does not prevent reentrancy attacks

0xnick

Summary

Modifier is incorrectly implemented and does not prevent reentrancy attacks

Vulnerability Details

As per the provided link in NatSpec, the correct implementation is the following:

modifier nonreentrant {
assembly {
if tload(0) { revert(0, 0) }
tstore(0, 1)
}
_;
// Unlocks the guard, making the pattern composable.
// After the function exits, it can be called again, even in the same transaction.
assembly {
tstore(0, 0)
}
}

The main difference is that we load at store at slot 0, then store 1 in it and finally revert it to 0 after transaction. But in our implementation we load from storage slot 1 but write to storage slot 0, thus our function does not prevent reentrancy.

Likelihood: Medium. Requires a malicious contract interaction (e.g., via ERC-777 hooks or a crafted recipient), which is feasible but not guaranteed in all deployments.

This attack contract is from the owner point of view to present the reentrancy attack. In reality an attacker can choose to exploit another function.

contract ReentrancyAttack {
InheritanceManager im;
constructor(address _im) {
im = InheritanceManager(_im);
}
function attack(address token, uint256 amount) external {
im.sendERC20(token, amount, address(this));
}
fallback() external {
if (address(im).balance > 0) {
im.sendERC20(token, amount, address(this));
}
}
}

Impact

High. If exploited, reentrancy could drain funds (e.g., via sendERC20 or sendETH), a classic critical vulnerability.

Tools Used

  • Manual Review

Recommendations

Fix the storage slot from which we are reading:

modifier nonReentrant() {
assembly {
+ if tload(0) { revert(0, 0) }
- if tload(1) { revert(0, 0) }
tstore(0, 1)
}
_;
assembly {
tstore(0, 0)
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong value in nonReentrant modifier

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong value in nonReentrant modifier

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.