Inheritable Smart Contract Wallet

Summary

The deadline variable in the InheritanceManager contract is never initialized in the constructor. This critical oversight could allow immediate inheritance if _setDeadline() isn't called elsewhere, completely bypassing the intended time-lock protection mechanism.

Vulnerability Details

The constructor of the InheritanceManager contract does not initialize the deadline variable:

The deadline is meant to be a critical time-lock mechanism that prevents inheritance until a certain time has passed. However, without initialization:

1. The deadline variable defaults to 0

2. Since block.timestamp is always greater than 0, the condition block.timestamp < getDeadline() in the inherit() function will be false

3. This allows immediate inheritance without waiting for any time period

Impact

This vulnerability could lead to:

1. Immediate inheritance without any waiting period

2. Complete bypass of the time-lock protection mechanism

3. Potential theft of assets

4. Fundamental failure of the contract's core security model

The severity is high because it completely breaks the time-lock protection that is central to the contract's security model, potentially allowing immediate unauthorized access to all assets.

Tools Used

Manual code review

Recommendations

Initialize the deadline variable in the constructor: