Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Backup scenario fails due to unset `InheritanceManager::isInherited`, potentially leading to loss of funds

olayinkablexxy

Summary

The inherit function does not update the InheritanceManager::isInherited state when the contract is used as a backup (i.e., when there is only one beneficiary). As a result, the new owner (the backup wallet) cannot call InheritanceManager::withdrawInheritedFunds because InheritanceManager::isInherited remains false. This breaks the intended functionality of the contract as a backup solution, as the new owner must add another beneficiary to set isInherited to true, which is not intuitive or user-friendly. This can also lead to loss of funds if the new owner doesn't think to add a new wallet as beneficiary.

Vulnerability Details

POC

Place the test below in ./test/InheritanceManagerTest.t.sol file:

function test_backup_solution_fails() external {
vm.prank(owner);
im.addBeneficiery(user1);
usdc.mint(address(im), 9e18);
vm.warp(1 + 90 days);
vm.startPrank(user1);
im.inherit();
​
// cannot withdraw
vm.expectRevert();
im.withdrawInheritedFunds(address(usdc));
vm.stopPrank();
}

Impact

  • Loss of funds as the new owner (backup wallet) can't withdraw the inherited funds

  • Contract can't be used as a backup solution as stated in the project README

Tools Used

  • Manual Review

  • Foundry

Recommendations

Set the inherited to true when InheritanceManager::inherit is called. Also, the owner must be set to the backup wallet not msg.sender

function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
​
if (beneficiaries.length == 1) {
- owner = msg.sender;
+ owner = beneficiaries[0];
_setDeadline();
+ isInherited = true;
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.