Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Uninitialized deadline in the InheritanceManager constructor

olayinkablexxy

Summary

The InheritanceManager::deadline state variable is not initialized. While this does not immediately enable an attack, it leaves the contract in an uninitialized state until InheritanceManager::addBeneficiary is called. This creates a temporary window of risk where the contract's inactivity period mechanism is not properly enforced. Additionally, if the owner forgets to call InheritanceManager::addBeneficiery or delays it, the contract remains in an uninitialized state, which could lead to unintended behavior or mismanagement.

POC

Update the setup in InheritanceManagerTest.t.sol:

function setUp() public {
+ vm.warp(10);// update the timestamp
vm.prank(owner);
im = new InheritanceManager();
usdc = new ERC20Mock();
weth = new ERC20Mock();
}

Place the test below in InheritanceManagerTest.t.sol:

function test_uninitialized_deadline() external {
assertNotEq(im.getDeadline(), block.timestamp);
}

Impact

  • The contract remains uninitialized until addBeneficiery is called, creating a window of risk where the inactivity period mechanism is not enforced.

  • Poor User Experience: The owner must manually call addBeneficiery to initialize the contract.

Tools Used

  • Manual Review

Recommendations

Initialize the deadline in the constructor to ensure the contract is fully initialized upon deployment:

constructor() {
owner = msg.sender;
nft = new NFTFactory(address(this));
+ _setDeadline(); // Initialize the deadline
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

constructor does not initialize deadline

Appeal created

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.