Inheritable Smart Contract Wallet

Summary

The inherit() function does not handle cases where no beneficiaries are set, leading to permanent contract lockup after the 90-day inactivity period. If the owner fails to assign beneficiaries before becoming inactive, there is no way to recover ownership or distribute funds. This results in all assets being permanently locked inside the contract, with no mechanism for retrieval.

Vulnerability Details

The inherit() function assumes that at least one beneficiary exists but does not account for the scenario where beneficiaries.length == 0. When this happens, the function reverts with InvalidBeneficiaries(), making the contract completely inaccessible.

Since there is no fallback mechanism to allow recovery, all funds inside the contract become permanently locked if the owner fails to assign beneficiaries before the inactivity period expires.

Vulnerable Code:

Impact

If no beneficiaries are set before the 90-day inactivity period expires, the contract becomes permanently locked. This means that all assets stored inside the contract are lost forever.

• The owner cannot recover funds, even if they later regain access to their wallet.

• Beneficiaries cannot inherit since the function always reverts.

• There is no administrative override, making the contract completely unusable.

• Any ETH or tokens locked in the contract remain inaccessible indefinitely.

Proof of Concept (PoC)

1. Deploy the InheritanceManager contract.

2. Do not add any beneficiaries.

3. Wait 90 days without interacting with the contract.

4. Attempt to call inherit().

5. The function reverts with InvalidBeneficiaries(), leaving the contract permanently locked.

Tools Used

• Manual review

Recommendations

• Implement a Fallback Mechanism: Modify the inherit function to handle the no-beneficiary case by, for example, reverting ownership to the original owner.

• Designate a Default Beneficiary: Configure a default beneficiary (e.g., a trusted address or charity) to ensure the contract does not become locked.

• Add a Reset Mechanism: Introduce a function allowing the owner to reset the inactivity timer or add beneficiaries post-elapse, preventing permanent lockup.