Inheritable Smart Contract Wallet

Summary

In the functions withdrawInheritedFunds and buyOutEstateNFT, the contract divides the total funds or asset values equally among beneficiaries using Solidity’s integer division. Because integer division truncates any remainder, if the balance (or NFT value) isn’t perfectly divisible by the number of beneficiaries, a residual amount is left undistributed. Over time, these residual funds may accumulate and become permanently locked within the contract, potentially leading to economic losses and reduced funds available for rightful heirs.

Vulnerability Details

Description:

• In both withdrawInheritedFunds and buyOutEstateNFT, the contract calculates the per-beneficiary share using division. For example, if 10 ETH is distributed among 3 beneficiaries, each gets 3 ETH (i.e. 10 / 3 = 3), leaving a residual 1 ETH in the contract.

• The contract does not include any mechanism to handle or reclaim this remainder, causing those funds to remain locked permanently.

Affected Functions:

• withdrawInheritedFunds(address _asset)

• buyOutEstateNFT(uint256 _nftID)

Root Cause

The core issue arises from the use of Solidity’s integer division which floors the result. When the total value is not evenly divisible by the number of beneficiaries, the remainder is dropped and never allocated. The lack of a mechanism to manage or redistribute these residual funds is the root cause of the vulnerability.

Impact

• Economic Loss: Residual funds accumulate over multiple distributions, potentially locking away a significant amount of assets that beneficiaries are entitled to.

• User Funds Locked: Beneficiaries may not receive the full value they are due, while the contract balance could become inflated with “stuck” funds.

Tools Used

• Remix & Manual Code Review: To inspect the logic and verify the division operations.

Mitigation

• Residual Handling: Implement a mechanism to collect and distribute the residual funds. For example, add a final distribution step that:

  • Sends any remaining funds to the owner or a designated recovery address, or

  • Accumulates the remainder and periodically distributes it to beneficiaries in subsequent transactions.