Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Uninitialized Trustee Address in Trustee.sol

willubedaone

Summary

A critical vulnerability has been identified in the Trustee.sol contract where the trustee address remains uninitialized at deployment. This prevents trustee-restricted functions from being executed until a trustee is explicitly appointed, leading to unexpected contract behavior.

Vulnerability Details

  • The contract declares a trustee address but never initializes it. In Solidity, state variables that are not explicitly initialized default to 0x0 (the zero address). This leads to a critical security issue:

  • Before the trustee is set, no valid address is assigned to it.

  • Any external account (EOA or contract) can potentially call functions restricted by onlyTrustee, depending on how the contract is deployed or inherited.

    • This can lead to unauthorized modifications of sensitive contract state, including:

      Changing NFT values (setNftValue)

      Changing the asset used for payments (setAssetToPay)

Impact

  • Unauthorized control over NFT valuation.

  • Unauthorized asset redirection (if the contract handles payments or token transactions).

  • Potential complete contract compromise if this contract is meant to act as a gatekeeper for asset management.

The Code

address trustee;

Why Is This a Problem?

  • By default, trustee is initialized to address(0) (the zero address).

  • The onlyTrustee modifier prevents anyone from calling functions that require trustee privileges:

modifier onlyTrustee() {
if (msg.sender != trustee) {
revert NotTrustee(msg.sender);
}
_;
}

  • Since trustee == address(0), no valid Ethereum address can match this check, making onlyTrustee functions permanently unusable.

Tools Used

Manual Review

Recommendations

Initialize trustee in the constructor:

constructor(address initialTrustee) {
require(initialTrustee != address(0), "Invalid trustee address");
trustee = initialTrustee;
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.