Submission Details
Severity:
Single Beneficiary Inheritance Logic Flaw
Summary : The inherit() function has a logical flaw when only one beneficiary exists, allowing anyone to claim ownership, not just the listed beneficiary.
Vulnerability Details : When there's only one beneficiary, the inherit() function allows msg.sender to become the owner without verifying they are the beneficiary:
function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
if (beneficiaries.length == 1) {
owner = msg.sender; // No check if msg.sender is the beneficiary!
_setDeadline();
} else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}
Impact : High. Anyone can steal a contract with a single beneficiary once the timelock expires.
Tools Used
Recommendations: Add a check to ensure only the registered beneficiary can inherit when there's a single beneficiary:
function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
if (beneficiaries.length == 1) {
if (msg.sender != beneficiaries[0]) {
revert NotBeneficiary(msg.sender);
}
owner = msg.sender;
_setDeadline();
} else if (beneficiaries.length > 1) {
// Only allow a beneficiary to trigger inheritance
bool isBeneficiary = false;
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
isBeneficiary = true;
break;
}
}
if (!isBeneficiary) {
revert NotBeneficiary(msg.sender);
}
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}
Updates
Lead Judging Commences
0xtimefliez 5 months ago
Submission Judgement Published Assigned finding tags:
Inherit depends on msg.sender so anyone can claim the contract
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.