Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Security Analysis: Function Name Typo - `addBeneficiery`

0x68

Summary

The InheritanceManager contract contains a function name typo where addBeneficiery is used instead of the correct spelling addBeneficiary. While this is a low-severity issue, it affects code readability, documentation consistency, and could potentially lead to confusion for developers interacting with the contract.

Vulnerability Details

The function at line 153 is defined as:

function addBeneficiery(address _beneficiary) external onlyOwner {
beneficiaries.push(_beneficiary);
_setDeadline();
}

The name addBeneficiery contains a spelling error - the correct spelling should be addBeneficiary, consistent with:

  1. The storage variable name beneficiaries (correctly spelled)

  2. The related function removeBeneficiary (correctly spelled)

  3. The parameter name _beneficiary (correctly spelled)

  4. The function documentation comment (which uses "beneficiary" correctly)

Impact

The impact of this issue is low. It does not affect the contract's functionality or security directly, but it may cause:

  1. Developer Confusion: Inconsistent naming can lead to confusion when working with the contract, especially for developers who might expect the correctly spelled function name.

  2. Integration Issues: External systems or frontends that try to interact with the contract using the correctly spelled function name would fail.

  3. Documentation Discrepancies: If any external documentation refers to the function with the correct spelling, it would create inconsistencies.

  4. Maintenance Challenges: The inconsistency might lead to difficulties during code maintenance or auditing.

Tools Used

Manual code review.

Recommendations

  1. Rename the function to use the correct spelling:

/**
* @dev adds a beneficiary for possible inheritance of funds.
* @param _beneficiary beneficiary address
*/
function addBeneficiary(address _beneficiary) external onlyOwner {
beneficiaries.push(_beneficiary);
_setDeadline();
}

  1. Consider adding input validation to prevent adding invalid addresses (e.g., zero address) as beneficiaries:

function addBeneficiary(address _beneficiary) external onlyOwner {
require(_beneficiary != address(0), "Invalid beneficiary address");
beneficiaries.push(_beneficiary);
_setDeadline();
}

  1. To improve transparency, emit an event when a beneficiary is added:

event BeneficiaryAdded(address indexed beneficiary);
​
function addBeneficiary(address _beneficiary) external onlyOwner {
require(_beneficiary != address(0), "Invalid beneficiary address");
beneficiaries.push(_beneficiary);
emit BeneficiaryAdded(_beneficiary);
_setDeadline();
}

  1. Review the codebase for other similar typos or naming inconsistencies.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.