Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Multiple owner-only functions fail to reset the inactivity timer, enabling premature inheritance activation

anchabadze

Description:

The Inheritable Smart Contract Wallet protocol is designed with a fundamental invariant:

EVERY transaction the owner does with this contract must reset the 90 days timer

However, this crucial invariant is violated in three owner-only functions that don't call _setDeadline().

Affected functions:

function removeBeneficiary(address _beneficiary) external onlyOwner {
uint256 indexToRemove = _getBeneficiaryIndex(_beneficiary);
delete beneficiaries[indexToRemove];
// Missing _setDeadline();
}
​
function createEstateNFT(string memory _description, uint256 _value, address _asset) external onlyOwner {
uint256 nftID = nft.createEstate(_description);
nftValue[nftID] = _value;
assetToPay = _asset;
// Missing _setDeadline();
}
​
function contractInteractions(address _target, bytes calldata _payload, uint256 _value, bool _storeTarget)
external
nonReentrant
onlyOwner
{
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
interactions[_target] = data;
}
// Missing _setDeadline();
}

Impact:

This inconsistency breaks a core security mechanism of the protocol, potentially allowing premature inheritance activation despite recent owner activity:

If an owner exclusively uses the affected functions (e.g., only managing NFTs or interacting with external contracts), the inactivity timer won't reset, allowing beneficiaries to trigger inheritance after 90 days despite active owner management.

The 90-day inactivity period is a fundamental safety feature designed to ensure inheritance only activates when the owner is truly inactive. This vulnerability undermines that design.

Beneficiaries could claim inheritance while the owner is still actively managing assets, creating legal and procedural conflicts.

Recommended Mitigation:

Add the _setDeadline() call to all owner-only functions to maintain the protocol invariant

Updates

Lead Judging Commences

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.