Inheritable Smart Contract Wallet

Summary

The nonReentrant modifier in InheritanceManager implementation of Transient Storage Reentrancy Guard contains an implementation error leading to ineffective reentrancy protection.

Vulnerability Details

In nonReentrant modifier there is a mismatch between the storage slots being checked and modified, the code checks slot 1 but sets slot 0, making the reentrancy protection ineffective.

Impact

The severity of the security vulnerability described above is mitigated by the presence of the onlyOwner modifier on the affected functions because:

1. Limited attack vector - The functions protected by this modifier (sendERC20, sendETH, and contractInteractions) are also protected by the onlyOwner modifier, meaning only the contract owner can call these functions.

2. Trust Assumption - Since the owner is presumably trusted, the risk of a malicious reentrancy attack from the owner is less likely to happen.

However, there are still potential concerns:

1. Unintentional Reentrancy - Even a trusted owner could trigger reentrancy by making external calls to malicious contracts.

2. False Security - The contract claims to implement reentrancy protection, but it's ineffective, which could lead to false security assumptions.

Tools Used

Manual code review

Recommendations

Follow the proper implementation: https://soliditylang.org/blog/2024/01/26/transient-storage