Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Beneficiaries can deny withdrawal of eth for all beneficiary

al88nsk

Summary

If a beneficiary is a contract, it can implement the fallback function that will always fail and thus deny withdrawal for all beneficiaries.

Vulnerability Details

Function InheritanceManager::withdrawInheritedFunds iterates through all beneficiaries and send them eth via call:

if (_asset == address(0)) {
uint256 ethAmountAvailable = address(this).balance;
uint256 amountPerBeneficiary = ethAmountAvailable / divisor;
for (uint256 i = 0; i < divisor; i++) {
address payable beneficiary = payable(beneficiaries[i]);
(bool success,) = beneficiary.call{value: amountPerBeneficiary}("");
require(success, "something went wrong");
}
}

If a beneficiary is a contract, it can implement fallback function that will always fail. In this case no one will be able to receive eth since the function will always revert.

Impact

Beneficiaries will be unable to receive eth.

Tools Used

Manual review

Recommendations

Use pull over push pattern so that each beneficiary will call a function wo withdraw their share.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!