Submission Details
Severity:
`InheritanceManager::contractInteractions` do not affect deadline value
Description: Based on Core Assumptions and Invariants, every transaction the owner executes with this contract must reset the 90-day timer. However, when the contract owner calls contractInteractions, the deadline value does not change. This breaks the invariants rule.
Proof of Concept: I write a new test inside InheritanceManagerTest:
function test_contractInteractionsDoNotAffectDeadline() public {
uint256 deadline = im.getDeadline();
uint256 expectedDeadline = 1 + 90 days;
usdc.mint(address(im), 10e18);
vm.warp(1);
vm.startPrank(owner);
bytes memory payload = abi.encodeWithSelector(usdc.transfer.selector, user1, 1e18);
console.log(usdc.balanceOf(address(im)));
im.contractInteractions(address(usdc), payload, 0, true);
assertEq(usdc.balanceOf(address(im)), 9e18);
assertEq(usdc.balanceOf(user1), 1e18);
deadline = im.getDeadline();
assertEq(deadline, expectedDeadline);
vm.stopPrank();
}
This test result fails because the deadline value doesn't change.
Recommended Mitigation: You must call _setDeadline(); at the end of InheritanceManager::contractInteractions.
function contractInteractions(address _target, bytes calldata _payload, uint256 _value, bool _storeTarget)
external
nonReentrant
onlyOwner
{
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
interactions[_target] = data;
}
+ _setDeadline();
}
Updates
Lead Judging Commences
0xtimefliez 6 months ago
Submission Judgement Published Assigned finding tags:
functions do not reset the deadline
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.