Description:

The function InheritanceManager::inherit allows anyone to call it. If there is only one beneficiary, msg.sender automatically becomes the owner without verification.

This makes the function vulnerable to a front-running attack where a malicious user (or an MEV bot) detects that the deadline has passed and front-runs the legitimate beneficiary’s transaction. By paying a higher gas fee, the attacker ensures that their transaction executes first, thereby taking full control of the contract.

Since ownership provides complete control over the smart contract, the attacker can steal all funds by transferring them to their own wallet.

Impact:

The Impact is high because the attacker becomes the new owner and can withdraw all assets. Likelihood is High, the attack can be performed whenever the contract has only one beneficiary and the deadline has passed.

Proof of Concept:

Recommended Mitigation:

To mitigate this issue we can add a check to only allow the only beneficiary inside the array to claim the ownership of the contract.