Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-11] DoS possibility in `InheritanceManager::buyOutEstateNFT` if one beneficiary is blacklisted in ERC-20 withdraws

0xnick

Summary

Some ERC-20 tokens (e.g., USDT, USDC on certain networks) implement blacklisting mechanisms where specific addresses are prohibited from receiving tokens. If a transfer to a blacklisted address is attempted, the transaction reverts.

Vulnerability Details

In buyOutEstateNFT, after the caller transfers tokens via safeTransferFrom, the function distributes tokens to other beneficiaries via safeTransfer in a loop. If one beneficiary is blacklisted by the assetToPay token, the transfer reverts, halting the function and preventing NFT burn.

Assume a simplified ERC-20 token with blacklisting (e.g., mimicking USDT):

contract BlacklistToken {
mapping(address => uint256) public balanceOf;
mapping(address => bool) public blacklisted;
​
function transfer(address to, uint256 amount) external returns (bool) {
require(!blacklisted[to], "Recipient blacklisted");
balanceOf[msg.sender] -= amount;
balanceOf[to] += amount;
return true;
}
}

  1. Deploy InheritanceManager and BlacklistToken.

  2. Owner adds a blacklisted address (e.g., 0xdead...) as a beneficiary.

  3. Fund the contract with BlacklistToken tokens.

  4. After inheritance, call buyOutEstateNFT(nftId).

  5. safeTransfer to the blacklisted address reverts, failing the entire transaction.

Impact

High. The beneficiaries will not be able to withdraw from the contract, leaving the funds locked.

Tools Used

  • Manual Review

Recommendations

Implement a pull-payment pattern to mitigate DoS by allowing beneficiaries to withdraw their ERC-20 shares individually, rather than distributing funds in a single transaction. This isolates the impact of a malicious beneficiary to their own withdrawal.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.