Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect ERC20 value distributed to other beneficiaries in `InheritanceManager:buyOutEstateNFT`

vincent71399

Description: In InheritanceManager:buyOutEstateNFT, the payment made by the buyer should be evenly divided among the remaining beneficiaries.
Therefore, the correct distribution formula should be fullAmount / (beneficiaries.length - 1) instead of fullAmount / beneficiaries.length.
Currently, the function buyOutEstateNFT incorrectly includes the buyer in the divisor, leading to some ERC-20 tokens being left in the contract.

function buyOutEstateNFT(uint256 _tokenId) external payable {
...
@> IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
...
}

Impact: This issue result in other beneficiaries receiving less than the intended amount

Proof of Concept:
Add the following test and run it

function test_buyOutEstateWrongValueDistribution() public {
vm.startPrank(owner);
im.addBeneficiery(beneficiary1);
im.addBeneficiery(beneficiary2);
im.addBeneficiery(beneficiary3);
im.createEstateNFT("my estate", 3e18, address(usdc));
vm.stopPrank();
​
vm.warp(im.getDeadline());
im.inherit();
​
usdc.mint(beneficiary3, 2e18); // buyer only need to pay 2/3 of the total value
vm.startPrank(beneficiary3);
usdc.approve(address(im), 2e18);
im.buyOutEstateNFT(1);
vm.stopPrank();
​
assertLt(usdc.balanceOf(beneficiary1), 1e18); // other beneficiaries should receive 1e18, but they receive less
assertLt(usdc.balanceOf(beneficiary2), 1e18);
}

Recommended Mitigation:
Change the divisor to beneficiaries.length - 1 to exclude the buyer from the distribution.

function buyOutEstateNFT(uint256 _tokenId) external payable {
...
- IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
+ IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / multiplier);
...
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has wrong denominator

buyOutNFT has return instead of continue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!