Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

[M-1] Missing `InheritanceManage::_setDeadline()` in Constructor Allows Premature Execution of `InheritanceManage::inherit()` and breaks a main Invariant.

agmguindo

Description:

The constructor of InheritanceManager does not call _setDeadline(), leaving deadline uninitialized (defaulting to 0). This allows anyone to pass the first check inside inherit(), effectively bypassing the 90-day timelock requirement.

Although it is not fully exploitable due to the necessity of having at least one beneficiary before claiming ownership, this breaks a core protocol invariant:

Invariant 2: Nobody should be able to take ownership of the contract before 90 days.

​
constructor() {
owner = msg.sender;
nft = new NFTFactory(address(this));
// @audit-high: `_setDeadline()` is missing here, making `deadline` default to 0.
}
​
function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough(); //This check is bypassed if `deadline == 0`
}
if (beneficiaries.length == 1) {
owner = msg.sender;
_setDeadline();
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}

Impact:

Medium Severity

Likelihood: Moderate – While full exploitation is not possible due to missing beneficiaries, the timelock mechanism is effectively broken.

Breaks a Key Security Assumption: The contract should not allow premature execution of inherit().

Proof of Concept:

PoC
​
​
function test_audit_CheckInitialLockTimeAndCheckInitialBeneficiaries()
public
{
uint256 deadLine = im.getDeadline();
​
console.log(deadLine);
vm.startPrank(user1);
im.inherit();
}
​

logs: InheritanceManager::inherit()
[Revert] InvalidBeneficiaries()

Meaning we pass the first check

if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough(); //This check is bypassed if `deadline == 0`
}

Recommended Mitigation:

To ensure that the contract enforces the 90-day timelock, _setDeadline(); should be called inside the constructor.

​
constructor() {
owner = msg.sender;
nft = new NFTFactory(address(this));
+ _setDeadline();
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

constructor does not initialize deadline

Appeal created

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!