Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control in `InheritanceManager::inherit` function allows unauthorized ownership takeover

freesultan

Summary

The inherit function lacks any access control mechanism, permitting anyone to call it after 90 days of owner inactivity. If there is exactly one beneficiary, the caller becomes the new owner of the contract, enabling an unauthorized party to gain full control. This undermines the intended inheritance logic and exposes the contract to a critical security risk.

Vulnerability Details

The following function is marked as external with no restrictions on who can call it. Afther 90 days of inactivity any address can call it.

function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
@> if (beneficiaries.length == 1) {
@> owner = msg.sender;
_setDeadline();
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}

In the case `beneficiaries.length == 1`, The caller (msg.sender) is assigned as the new owner, and the deadline is reset via _setDeadline(). This allows the new owner to execute privileged functions like sendETH, sendERC20, and contractInteractions.

Impact

An attacker can take over the contract if there’s one beneficiary, gaining access to all assets and control functions, effectively locking out the original owner and beneficiary.

Tools Used

Manual code review

Recommendations

Restrict this function to Owner or Beneficiary

Updates

Lead Judging Commences

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.