Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No possibility to send ETH to `InheritanceManager` contract

arinthal

Summary

The InheritanceManager contract cannot receive ETH.

Vulnerability Details

By default, Ethereum smart contracts cannot accept ETH unless explicitly designed to do so. A contract can receive ETH in the following ways:

  1. Defining a receive() function.

  2. Defining a fallback() function.

  3. Implementing a payable function that is explicitly called.

  4. Using another contract that calls selfdestruct() function (not recommended in this case).

The InheritanceManager contract lacks all of these methods, making it impossible to send ETH using standard approaches (see PoC).

Impact

The contract does not fulfill its basic wallet functionality because it cannot receive ETH for management.

Proof of Code

Add the following code to the InheritanceManagerTest.t.sol file within the InheritanceManagerTest contract.

function test_receivingEthByInheritanceManagerContractFail() public {
vm.deal(owner, 1 ether);
vm.prank(owner);
vm.expectRevert();
(bool success, ) = address(im).call{value: 1 ether}("");
require(success, "Transfer Failed");
}

Tools Used

  • Manual Review

  • Foundry

Recommended Mitigation

To allow ETH transfers, the InheritanceManager contract should implement either receive or fallback function (see docs: https://docs.soliditylang.org/en/v0.8.26/contracts.html#receive-ether-function or https://docs.soliditylang.org/en/v0.8.26/contracts.html#fallback-function).

Alternatively, a payable function can be added, such as

event Deposit(address sender, uint amount);
​
function deposit() external payable {
require(msg.value > 0, "Must send some ETH");
emit Deposit(msg.sender, msg.value);
}

This ensures the contract can accept ETH efficiently.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing receive() or fallback() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!