Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of check if contract is inherited in the `InheritanceManager::buyOutEstateNFT` function, Beneficiaries can trigger early buy out

ssalaudeen10

Summary

In the InheritanceManager.sol contract the Estate Nfts are expected to help the beneficiaries make claim/know the real life assets own by the owner of the contract and also any of the beneficiaries can buy out other beneficiaries buy paying equal share amount of the value to others. Buying out others should only be donw when this contract have been inherited only but the InheritanceManager::buyOutEstateNFT does not check for this requirement

Vulnerability Details

The following test case shows how a beneficiary can do an early buy out

​
function test_can_buy_out_nft_any_time()public{
address user2 = makeAddr("user2");
uint256 startingBalanceOfUser2 = usdc.balanceOf(user2);
vm.startPrank(owner);
// Owner created an NFT
im.createEstateNFT("A proche car", 10 ether, address(usdc));
// Owner added Both user 1 and user2 as beneficiary
im.addBeneficiery(user1);
im.addBeneficiery(user2);
vm.stopPrank();
vm.startPrank(user1);
// User 1 mint 10 USDC
usdc.mint(user1, 10 ether);
// User2 approve transfer of 10 USDC
usdc.approve(address(im), 10 ether);
// Immediately Buys Out the beneficiaries Shares
im.buyOutEstateNFT(1);
vm.stopPrank();
uint256 endingBalanceOfUser2 = usdc.balanceOf(user2);
vm.assertEq(startingBalanceOfUser2, 0);
assert(endingBalanceOfUser2 > 2 ether);
}
​

Impact

Beneficiary can buyout other beneficiaries early

Tools Used

Foundry test

Recommendations

The InheritanceManager::buyOutEstateNFT function should check if the contract is inherited else it should revert code implementation below

​
function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
+ if(!isInherited){
+ revert NotYetInherited();
+ }
// other relevant codes
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!