Unauthorized Ownership Takeover via inherit() Function
Summary
The inherit() function in InheritanceManager.sol allows anyone to call it, and if there is only one beneficiary, the function assigns ownership to msg.sender without verifying their identity. This means any random user can call InheritanceManager.sol::inherit() and claim ownership of the contract, potentially allowing them to withdraw all funds.
Vulnerability Details
The function lacks caller verification, allowing any address to inherit ownership if there's only one beneficiary.
Impact
Loss of ownership: A malicious user can take control of the contract.
Loss of funds: The new unauthorized owner can withdraw all stored assets.
Tools Used
Foundry (Forge) for testing
Recommendations
Restrict inherit() to only allow valid beneficiaries to inherit ownership. This can be done by checking if the caller is in the beneficiaries data structure before transferring ownership.
Lead Judging Commences
Inherit depends on msg.sender so anyone can claim the contract
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.