Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

buyOutEstateNFT Allows Free Claims if Few Beneficiaries

willubedaone

Summary

The buyOutEstateNFT function in the InheritanceManager contract has a logic flaw that allows certain beneficiaries to claim estate NFTs for free or at a significant discount when the number of beneficiaries is small. This could result in an unfair distribution of inherited assets.

Vulnerability Details

function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
uint256 finalAmount = (value / divisor) * multiplier;
​
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount);
​
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
return;
} else {
IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
}
}
​
nft.burnEstate(_nftID);
}

The formula for finalAmount is

finalAmount = (value / divisor) * multiplier;

  • When there are only two beneficiaries, divisor = 2, and multiplier = 1, so:

    finalAmount = (value / 2) * 1; // The buyer only pays half of the estate value

  • However, in the loop, the buyer is excluded from receiving the compensation, meaning the remaining one beneficiary only gets half the estate's value.

  • This results in the buyer paying nothing effectively while taking full ownership of the NFT.

  • For a single beneficiary (divisor = 1), the multiplier (0) makes finalAmount = 0, allowing a free claim.

Impact

  • When a beneficiary buys out an estate NFT, the function incorrectly calculates the required payment amount.

  • If there are only two beneficiaries, the buyer effectively pays nothing due to how multiplier is calculated.

  • This allows one beneficiary to take full ownership of an estate NFT without compensating the other beneficiaries fairly, leading to financial losses.

Tools Used

Manual Code Review

Recommendations

Fix the Buyout Payment Calculation

uint256 finalAmount = value; // Buyer must pay full price to take ownership
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has wrong denominator

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.