Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Early Termination of Distribution Loop in buyOutEstateNFT()

adepoju2006

Summary

The buyOutEstateNFT() function in ingeritancemanager.sol contains a return statement inside a loop, which prematurely stops the iteration when msg.sender is found in the beneficiaries array. As a result, any beneficiaries after msg.sender in the array do not receive their fair share of the funds, leading to loss of inheritance distribution.

Vulnerability Details

šŸ“Œ Vulnerable Code in buyOutEstateNFT(``)

for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
return; // šŸšØ EARLY EXIT! Stops fund distribution to later beneficiaries.
} else {
IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
}
}

āŒ What is Wrong?

  • The function loops through the beneficiaries to distribute funds.

  • When msg.sender (the buyer) is found in the array, the loop stops execution due to the return statement.

  • Any beneficiaries after msg.sender in the list will not receive their share.

  • This leads to unfair and incomplete inheritance payouts.

Impact

1ļøāƒ£ Some Beneficiaries Do Not Get Their Share

  • If a beneficiary calls buyOutEstateNFT() to purchase an estate NFT, the loop stops distributing funds once it finds them in the list.

  • This results in other beneficiaries losing their rightful inheritance.

2ļøāƒ£ Funds Can Be Stuck in the Contract

  • If the contract has an uneven number of beneficiaries, a portion of the funds may remain unclaimed.

Tools Used

Manuel Review

šŸš€ Proof of Concept (PoC)

šŸ“œ Given: List of Beneficiaries

beneficiaries = [0xAAA, 0xBBB, 0xCCC, 0xDDD];

Let's say:

  • msg.sender = 0xCCC (the buyer calling buyOutEstateNFT).

  • The loop starts from index 0.

šŸ›‘ Incorrect Execution (Current Code)

Step Current Beneficiary Action Taken
1ļøāƒ£ 0xAAA āœ… Paid
2ļøāƒ£ 0xBBB āœ… Paid
3ļøāƒ£ 0xCCC (msg.sender) āŒ Loop Stops! (return executed)
4ļøāƒ£ 0xDDD āŒ Never Reached!

šŸ”“ Result: 0xDDD does not receive their share! The loop stops at 0xCCC.

Recommendations

šŸ”§ Corrected Code

for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender != beneficiaries[i]) { // āœ… Skip buyer but continue loop
IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
}
}

āœ… Correct Execution (Fixed Code)

Step Current Beneficiary Action Taken
1ļøāƒ£ 0xAAA āœ… Paid
2ļøāƒ£ 0xBBB āœ… Paid
3ļøāƒ£ 0xCCC (msg.sender) ā© Skipped (Not Paid)
4ļøāƒ£ 0xDDD āœ… Paid!

šŸŸ¢ Result: Now all eligible beneficiaries except the buyer receive their fair share.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has return instead of continue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.