Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper Array Element Deletion Causes Loss of Funds to Zero Address

0xsalami

Summary

Improper Array Element Deletion Causes Loss of Funds to Zero Address

Description

The removeBeneficiary function deletes an element by using the delete method, which only sets the array element to its default value (address(0)) rather than removing it permanently from the array. When beneficiaries are added and later removed, the position they held still remains in the array, but the address becomes the zero address.
During inheritance distribution, shares intended for removed beneficiaries are sent to the zero address, meaning those funds are lost forever. As a result, the remaining beneficiaries receive less than their expected share of the distributed assets.

Impact

Beneficiaries do not receive the correct amount of their share from the asset distribution.

Proof of Concepts

function test_BadArrayDeletionLeadingToFundLoss() public {
address user2 = makeAddr("user2");
address user3 = makeAddr("user3");
address user4 = makeAddr("user4");
address user5 = makeAddr("user5");
vm.startPrank(owner);
im.addBeneficiery(user1);
im.addBeneficiery(user2);
im.addBeneficiery(user3);
im.addBeneficiery(user4);
im.addBeneficiery(user5);
im.removeBeneficiary(user4);
im.removeBeneficiary(user5);
vm.stopPrank();
vm.warp(1);
vm.deal(address(im), 9e18);
vm.warp(1 + 90 days);
vm.startPrank(user1);
im.inherit();
im.withdrawInheritedFunds(address(0));
vm.stopPrank();
// the assertion is expected to fail due to bad array deletion
// the beneficiaries length is still 5 and the funds is shared amongst 5 and not 3
// thefore beneficiaries will get 18e17 wei
vm.expectRevert();
assertEq(3e18, user1.balance);
assertEq(3e18, user2.balance);
assertEq(3e18, user3.balance);
}
​

Recommended mitigation

The removeBeneficiary function should implement a proper array deletion method to ensure deleted members are completely removed from the array. This would keep the beneficiaries list clean and prevent it from being bloated with zero addresses of deleted beneficiaries.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect removal from beneficiary list causes funds to be send to 0 address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.