Inheritable Smart Contract Wallet

Summary

Any beneficiary can appoint a trustee (a trustee can be even the same as the beneficiary appointing). Then the trustee can change both the asset and the value of any NFT. It is unclear how this helps beneficiares to settle claims on estates.

Vulnerability Details

A malicious beneficiary can set himself/herself as a trustee, lower NFT-s value (and/or change assets), and buy out the NFT at a low price. Other beneficiares have no way to change it back.

Impact

This makes the whole trustee system useless, it is hardly different from as if beneficiaries could directly change the price (and assets) of NFT-s.

Tools Used

Manual review

Recommendations

Redesign the trustee system. Get rid of trustees, or make sure that trustees can only change NFT-s if all beneficiaries agreed upon them.