Submission Details
Severity:
Incorrect Calculation Logic in `InheritanceManager::buyOutEstateNFT`
Description: The calculation for fund distribution in InheritanceManager::buyOutEstateNFT incorrectly computes each beneficiary's share. Beneficiaries may receive an amount that is lower than expected.
Impact: This error results in beneficiaries receiving less funds than they are entitled to, potentially leading to financial shortfalls and disputes.
Proof of Concept: Include the following test in the InheritanceManagerTest.t.sol file:
function testBuyOutEstateNFTSharesCheck() public {
address user2 = makeAddr("user2");
address user3 = makeAddr("user3");
vm.warp(1);
im.addBeneficiery(user1);
im.addBeneficiery(user2);
im.addBeneficiery(user3);
uint256 nftValue = 3e6;
im.createEstateNFT("our beach-house", nftValue, address(usdc));
usdc.mint(user3, 4e6);
vm.warp(1 + 90 days);
vm.startPrank(user3);
usdc.approve(address(im), 4e6);
im.inherit();
im.buyOutEstateNFT(1);
vm.stopPrank();
uint256 user1Balance = usdc.balanceOf(user1);
uint256 user2Balance = usdc.balanceOf(user2);
uint256 beneficiariesAmount = 3;
uint256 sharePerUser = nftValue / beneficiariesAmount;
assertLt(user1Balance, sharePerUser);
assertLt(user2Balance, sharePerUser);
}
Recommended Mitigation: Adjust the calculation to correctly distribute the funds:
function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
uint256 finalAmount = (value / divisor) * multiplier;
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount);
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
return;
} else {
- IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
+ IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / multiplier);
}
}
nft.burnEstate(_nftID);
}
Updates
Lead Judging Commences
0xtimefliez 4 months ago
Submission Judgement Published Assigned finding tags:
buyOutNFT has wrong denominator
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.