Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized Ownership Takeover Due to Missing Beneficiary Validation

0xsalami

[H-2] Unauthorized Ownership Takeover Due to Missing Beneficiary Validation

Description

The InheritanceManager::inherit function fails to verify that the caller (msg.sender) is the legitimate beneficiary when transferring ownership.Any random user who is not the designated beneficiary can become the owner of the smart contract if the beneficiaries array length is exactly 1 and
the inactivity period has exceeded the TIMELOCK period (90 days)

Impact

This vulnerability allows unauthorized users to seize control of the contract and its assets.

Proof of Concepts

function test_inheritOnlyOneBeneficiaryStranger() public {
vm.startPrank(owner);
address user2 = makeAddr("user2");
// adding `user2` as beneficiary, making the beneficiaries length one
im.addBeneficiery(user2);
vm.stopPrank();
vm.warp(1);
vm.deal(address(im), 10e10);
// ensuring deadline is passed
vm.warp(1 + 90 days);
vm.startPrank(user1);
// user1 inherits the account even tho they are not the beneficiary of the account
// therefore they have full access to the wallet and the owner has been compromised
im.inherit();
vm.stopPrank();
assertEq(user1, im.getOwner());
}
​

Recommended mitigation

The InheritanceManager::inherit function should implement a check to verify that msg.sender is the sole beneficiary in the beneficiaries array before transferring ownership:

function inherit() external {
if (block.timestamp < getDeadline()) {
revert InactivityPeriodNotLongEnough();
}
if (beneficiaries.length == 1) {
+ if (msg.sender != beneficiaries[0]) {
+ revert NotAuthorizedBeneficiary();
+ }
owner = msg.sender;
_setDeadline();
}
else if (beneficiaries.length > 1) {
isInherited = true;
} else {
revert InvalidBeneficiaries();
}
}
​
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inherit depends on msg.sender so anyone can claim the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!