Inheritable Smart Contract Wallet

Summary

The withdrawInheritedFunds function uses a push pattern to send funds to all beneficiaries in a single transaction, making it vulnerable to a DoS attack if one beneficiary rejects ETH (e.g., a contract without a receive function), causing the entire transaction to revert.

Vulnerability Details

The withdrawInheritedFunds function iterates over the beneficiaries array and sends ETH or ERC20 tokens to each beneficiary.

Impact

For ETH transfers, it uses a low-level call with require(success, "something went wrong").

If any beneficiary is a contract that rejects ETH (e.g., lacks a receive or fallback function or reverts intentionally), the call fails, and the entire transaction reverts.

This allows a single malicious beneficiary to block all fund withdrawals by rejecting ETH transfers.

Tools Used

Manual code review.

Recommendations

Switch to a Pull Pattern