Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Calculation Leading to Loss of Funds in `buyOutEstateNFT()`

0xshaedyw

Summary

The calculation of finalAmount in the buyOutEstateNFT function is incorrect, leading to a loss of funds. The formula (value / divisor) * multiplier truncates the division result before multiplication, causing an incorrect distribution of funds.

Vulnerability Details

The current calculation:

uint256 finalAmount = (value / divisor) * multiplier;

  • This divides value by divisor first, which truncates the result (due to Solidity’s integer division), and then multiplies by multiplier.

  • For example, if value = 100, divisor = 3, and multiplier = 2:

    • value / divisor = 100 / 3 = 33 (truncated).

    • 33 * 2 = 66 (incorrect result).

    • The correct result should be (100 * 2) / 3 = 66.666..., but Solidity truncates this to 66, causing a loss of 0.666...

Impact

  • The incorrect calculation results in a loss of funds during the buyout process.

Tools Used

Manual review

Recommendations

To avoid losing funds, we can:

  1. Calculate the base amount each beneficiary should receive (finalAmount / divisor).

  2. Calculate the remainder (finalAmount % divisor).

  3. Distribute the remainder to one of the beneficiaries (e.g., the first or last).

function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
require(block.timestamp >= deadline, "Deadline not yet passed");
require(nft.ownerOf(_nftID) == address(this), "Invalid NFT ID");
​
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
uint256 finalAmount = (value * multiplier) / divisor; // Base amount
uint256 remainder = (value * multiplier) % divisor; // Remainder
​
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount + remainder);
​
....
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has wrong denominator

buyOutNFT has return instead of continue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!