Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Several onlyOwner functions are not setting the deadline, which contradicts the documentation stating that `every transaction performed by the owner with this contract must reset the 90-day timer.`

vincent71399

Description:
The removeBeneficiary, createEstateNFT, and contractInteractions functions in the InheritanceManager contract do not update the deadline,
violating the documented requirement that every transaction by the owner should reset the 90-day timer.
This oversight introduces a critical risk, as the owner can continue interacting with the contract,
including transferring assets via contractInteractions, without resetting the inactivity timer.

Impact: By exploiting this issue, the owner could bypass the intended inactivity protection mechanism,
potentially allowing the contract to execute transfers (sendETH, sendERC20) as if the owner were inactive,
even when they are still actively engaging with the contract.
This undermines the security model designed to prevent unauthorized asset distribution due to owner inactivity.

Proof of Concept:
Add the following 2 test cases to the InheritanceManager.t.sol file and run the tests.

function test_bypassSetDeadlineSendETH() public {
uint256 deadlineBeforeTx = im.getDeadline();
vm.deal(address(im), 1 ether);
assertEq(address(im).balance, 1 ether);
assertEq(owner.balance, 0);
vm.prank(owner);
im.contractInteractions(owner, "", 1 ether, false);
assertEq(address(im).balance, 0);
assertEq(owner.balance, 1 ether);
assertEq(im.getDeadline(), deadlineBeforeTx);
}
​
function test_bypassSetDeadlineSendERC20() public {
uint256 deadlineBeforeTx = im.getDeadline();
​
usdc.mint(address(im), 5e18);
assertEq(usdc.balanceOf(address(im)), 5e18);
assertEq(usdc.balanceOf(owner), 0);
​
vm.prank(owner);
im.contractInteractions(
address(usdc),
abi.encodeWithSignature("transfer(address,uint256)",
owner, 1e18), 0, false);
​
assertEq(usdc.balanceOf(address(im)), 4e18);
assertEq(usdc.balanceOf(owner), 1e18);
​
assertEq(im.getDeadline(), deadlineBeforeTx);
}

Recommended Mitigation:
add setDeadline for these 3 functions

function contractInteractions(address _target, bytes calldata _payload, uint256 _value, bool _storeTarget)
external
nonReentrant
onlyOwner
{
...
+ _setDeadline();
}
​
function createEstateNFT(string memory _description, uint256 _value, address _asset) external onlyOwner {
...
+ _setDeadline();
}
​
function removeBeneficiary(address _beneficiary) external onlyOwner {
...
+ _setDeadline();
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

functions do not reset the deadline

constructor does not initialize deadline

Appeal created

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.