Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized Caller Can Call Inherit Function

apec

Summary

The inherit() function in InheritanceManager contract is missing access control, allowing anyone to call it and claim ownership of the contract, not just beneficiaries.

Vulnerability Details

In InheritanceManager contract, the inherit() function checks if the deadline has passed and if there are registered beneficiaries, but doesn't verify that msg.sender is actually a legitimate beneficiary. Once the inactivity period has elapsed, any external actor can call this function and claim ownership (if there is only one beneficiary) or alter the inheritance state (if there are more than one beneficiary).

function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
if (beneficiaries.length == 1) {
owner = msg.sender;
_setDeadline();
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}

Impact

The vulnerability described above has severe consequences:

  1. Unauthorized Ownership Transfer (very likely): If there's only one beneficiary registered, an attacker can call the function after the deadline and become the owner of the contract, gaining complete control over all assets.

  2. Unintended Inheritance Triggering (very likely): If there are multiple beneficiaries registered, an attacker can change the inheritance state isInherited = true, allowing premature funds withdrawal.

Tools Used

Manual code review

Recommendations

Add access control, to verify that the caller is one of the registered beneficiaries.

modifier onlyBeneficiary() {
bool isBeneficiary = false;
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
isBeneficiary = true;
break;
}
}
require(isBeneficiary, "Caller is not a beneficiary");
_;
}
​
function inherit() external onlyBeneficiary {
// Existing code
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.