Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

assetToPay should be linked to nftValue[nftID]

0xziin

Summary

assetToPay is not linked to any nftID, it means that at each minting of an EstateNFT, assetToPay will be updated with a possible different address
of token.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-03-inheritable-smart-contract-wallet/blob/main/src/InheritanceManager.sol#L146

/**
* @dev creates an NFT of an underlaying asset, for example real estate. Mints the nft and adds it
* into nftValue mapping, connecting it to a real world price.
* @param _description describes the asset, for example address or title number
* @param _value uint256 describing the value of an asset, we recommend using a stablecoin like USDC or DAI
* @param _asset the address of the asset in which beneficiaries would need to pay for that asset.
*/
function createEstateNFT(string memory _description, uint256 _value, address _asset) external onlyOwner {
uint256 nftID = nft.createEstate(_description);
nftValue[nftID] = _value;
assetToPay = _asset;
}

assetToPay not being linked to any nftID, it means that at each minting of an EstateNFT, assetToPay will be updated with a possible different address of token.

But USDC and DAI are not exactly at the same price. Plus, there is no restriction to assetToPay, it means it could be other than a stablecoin it will mess with previous values.\


==>For example :
(1) we execute createEstateNFT() with _value = 100 & _asset = USDC.
Then (2) we execute createEstateNFT() with _value = 200 & _asset = WETH.

Now (1) is not worth 100 USDC but 100 WETH.

Impact

Previous price values will be unaccurate, resulting in paying higher prices or lower prices with a different token that initially intended.

Tools Used

Manual review, Github.

Recommendations

assetToPay should be linked to a specific nftID and not global.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

global asset in NFT values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.