Inheritable Smart Contract Wallet

Description

The withdrawInheritedFunds() function in the InheritanceManager contract lacks proper access control mechanisms. While the function verifies that inheritance has been triggered via the isInherited flag, it does not restrict who can call the function. This means any external account, including non-beneficiaries, can initiate the distribution of assets to all beneficiaries.

This is inconsistent with other functions in the contract such as buyOutEstateNFT(), which uses an onlyBeneficiaryWithIsInherited modifier to restrict access to beneficiaries.

Impact

The lack of access control in this function poses several risks:

1. Unauthorized Distributions: Any external party can trigger the distribution of assets at any time after inheritance is set, potentially before beneficiaries are ready or aware.

2. Circumvention of Intent: The original design intended for beneficiaries to control when assets are distributed.( comment on the function: * @dev called by the beneficiaries to disperse remaining assets within the contract in equal parts.)

Recommendation

Implement proper access control by adding an appropriate modifier:

Tools Used

• Foundry Testing Framework

• Transaction Trace Analysis

• Manual Code Review