Submission Details
Severity:
Broken Beneficiary Removal Logic
Summary
The removeBeneficiary function deletes an entry but does not adjust the array length, leaving a zero address and breaking fund distribution.
Vulnerability Details
Using delete beneficiaries[indexToRemove] sets the address to zero but retains the array length. Subsequent iterations (e.g., in withdrawInheritedFunds) will include the zero address, causing failed ETH transfers or locked ERC20 tokens.
Impact
Funds may be permanently locked or transactions reverted, preventing beneficiaries from inheriting assets.
Tools Used
Manual review.
Recommendations
Replace the deletion with array element swapping and pop():
uint256 lastIndex = beneficiaries.length - 1;
beneficiaries[indexToRemove] = beneficiaries[lastIndex];
beneficiaries.pop();
Updates
Lead Judging Commences
0xtimefliez 6 months ago
Submission Judgement Published Assigned finding tags:
Incorrect removal from beneficiary list causes funds to be send to 0 address
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.