withdrawInheritedFunds presents a reentrancy risk because the balance of the beneficiary is not updated before the external call to receive the funds.
The function withdrawInheritedFunds does not respect the CEI pattern, threrefore it makes itself susceptible to reentrancy attacks, by a potentialy malicious contract that could recursively call the function to drain the contract funds.
The inheritanceManager contract could be drained of the funds that would correspond to its beneficiaries, resulting in loss of funds and no inheritance value.
Manual review
Update balance of beneficiaries before the external calls are made to follow CEI(Checks-Effects-Interactions) pattern
Use of pull-based merhod for withdrawing inherited funds
Use the nonReentrant() modifier to prevent recursive calls.
This code with the added changes:
-> prevents reentrancy(use nonReentrant modifier
-> follows CEI(Updates balances before making external calls)
-> avoids direct ETH transfers in loops(uses pull-based withdrawal pattern
-> protects against gas limits(Since each withdrawal is separate, no single transaction can fail due to out-of-gas errors)
Side note: I am submitting this entry from mobile, as I am away from my laptop for a couple of weeks, so I wasn't able to test this code, thank you for understanding.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.