Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Absence of Input Validation in `InheritanceManager::addBeneficiery `Enables Zero Address and Duplicate Beneficiary

summer

Summary

The addBeneficiery function in the InheritanceManager contract lacks critical input validation, allowing zero addresses and duplicate beneficiaries to be added. This can lead to permanent fund loss and inconsistent distribution of assets.

Finding Description

In the InheritanceManager contract, the addBeneficiery function lacks essential validation checks when adding new beneficiaries to the estate:

function addBeneficiery(address _beneficiary) external onlyOwner {
beneficiaries.push(_beneficiary);
_setDeadline();
}

The function does not validate whether the provided _beneficiary address is the zero address. If the zero address is added as a beneficiary, any funds transferred to this address during distribution will be permanently lost. There is no check to prevent the same address from being added multiple times to the beneficiaries array.

Impact Explanation

If the zero address is added as a beneficiary, funds sent to it during distribution are permanently and irrecoverably lost. Duplicate addresses artificially inflate the denominator in share calculations, leading to unfair distribution.

Recommendation

Consider using a mapping to track beneficiary status and Implement proper validation checks in the addBeneficiery function:

mapping(address => bool) public isBeneficiary;
​
function addBeneficiary(address _beneficiary) external onlyOwner {
require(_beneficiary != address(0), "Zero address not allowed");
require(!isBeneficiary[_beneficiary], "Beneficiary already exists");
beneficiaries.push(_beneficiary);
isBeneficiary[_beneficiary] = true;
_setDeadline();
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!