Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-10] DoS possibility in `InheritanceManager::withdrawInheritedFunds` if one beneficiary is blacklisted in ERC-20 withdraws

0xnick

Summary

Some ERC-20 tokens (e.g., USDT, USDC on certain networks) implement blacklisting mechanisms where specific addresses are prohibited from receiving tokens. If a transfer to a blacklisted address is attempted, the transaction reverts.

Vulnerability Details

In withdrawInheritedFunds (ERC-20 branch), safeTransfer is called in a loop to send tokens to each beneficiary. If one beneficiary is blacklisted by the ERC-20 contract (e.g., asset), the safeTransfer reverts, causing the entire function to fail.

Assume a simplified ERC-20 token with blacklisting (e.g., mimicking USDT):

contract BlacklistToken {
mapping(address => uint256) public balanceOf;
mapping(address => bool) public blacklisted;
​
function transfer(address to, uint256 amount) external returns (bool) {
require(!blacklisted[to], "Recipient blacklisted");
balanceOf[msg.sender] -= amount;
balanceOf[to] += amount;
return true;
}
}

  1. Deploy InheritanceManager and BlacklistToken.

  2. Owner adds a blacklisted address (e.g., 0xdead...) as a beneficiary.

  3. Fund the contract with BlacklistToken tokens.

  4. After inheritance, call withdrawInheritedFunds(address(BlacklistToken)).

  5. safeTransfer to the blacklisted address reverts, failing the entire transaction.

Impact

High. The beneficiaries will not be able to withdraw from the contract, leaving the funds locked.

Tools Used

  • Manual Review

Recommendations

Implement a pull-payment pattern to mitigate DoS by allowing beneficiaries to withdraw their ERC-20 shares individually, rather than distributing funds in a single transaction. This isolates the impact of a malicious beneficiary to their own withdrawal.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.