Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Deadline Updates in Contract Interactions

teoslaf

Summary

The InheritanceManager's contractInteractions function, which is meant for advanced operations like DeFi interactions, fails to update the activity deadline. This could cause unintended inheritance triggers for users who primarily use complex contract interactions.

Vulnerability Details

// Regular functions properly update deadline
function sendETH(uint256 _amount, address _to) external nonReentrant onlyOwner {
(bool success,) = _to.call{value: _amount}("");
require(success, "ETH transfer failed");
_setDeadline(); // Correctly updates deadline
}
​
function sendERC20(...) external nonReentrant onlyOwner {
...
_setDeadline(); // Correctly updates deadline
}
​
// But contractInteractions doesn't update deadline
function contractInteractions(
address _target,
bytes calldata _payload,
uint256 _value,
bool _storeTarget
) external nonReentrant onlyOwner {
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
interactions[_target] = data;
}
// Missing _setDeadline() call!
}

Critical issues:

  1. Inconsistent Deadline Updates

    • Regular transfers update deadline

    • Complex operations don't update deadline

    • Documentation claims all owner actions should update deadline

    • Implementation doesn't match documentation

  2. DeFi User Risk

    • Users primarily using DeFi integrations at risk

    • Complex operations don't prevent inheritance

    • Active contract usage might not be recognized

    • Technical users particularly vulnerable

Impact

HIGH - The vulnerability affects:

  1. Technical Users

    • DeFi interactions don't update deadline

    • Could lose control despite active usage

    • No warning about missing updates

  2. Contract Safety

    • Inconsistent activity tracking

    • Documentation/implementation mismatch

    • Complex operations not properly tracked

Recommendations

  1. Add Deadline Updates:

function contractInteractions(
address _target,
bytes calldata _payload,
uint256 _value,
bool _storeTarget
) external nonReentrant onlyOwner {
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
interactions[_target] = data;
}
_setDeadline(); // Add this line
}

  1. Consider Unified Activity Tracking:

contract InheritanceManager {
struct Activity {
uint256 lastUpdate;
mapping(address => bytes) interactions;
}
Activity public activity;
modifier updateActivity() {
_;
activity.lastUpdate = block.timestamp;
emit ActivityUpdated(msg.sender);
}
}

  1. Add Safety Features:

    • Activity dashboard

    • Deadline warnings

    • Clear activity status

    • Update notifications

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!