Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Duplicate Beneficiaries Can Be Added Without Validation

osuolale

Summary

The addBeneficiery function allows the same address to be added multiple times as a beneficiary, which can lead to redundant entries and potential unexpected behavior when distributing inheritance funds.

Vulnerability Details

  • The function does not check if _beneficiary is already in the beneficiaries array, meaning duplicate entries are possible.

  • If a beneficiary is added multiple times, they may be counted multiple times in iterative operations (e.g., fund distribution, inheritance claims).

  • This could lead to inefficient gas usage, unintended favoritism, or even reversion issues in loops that assume unique entries.

Problematic Code

function addBeneficiery(address _beneficiary) external onlyOwner { beneficiaries.push(_beneficiary); // ❌ No check for duplicates _setDeadline(); }

** No verification step** ensures _beneficiary is unique.

  • Allows duplicate entries, potentially causing unexpected behavior.

Impact

Gas inefficiency: Duplicate addresses in the beneficiaries array lead to unnecessary iterations in loops.

  • Potential over-distribution: If funds are allocated based on the number of times an address appears, a single user could receive more than intended.

  • Possible function reverts: If other contract functions assume unique entries and iterate over beneficiaries, an unexpected duplicate could break logic.

Tools Used

Manual Review

Recommendations

✅ Fix: Ensure Unique Beneficiaries

Modify the function to check for duplicates before adding a new beneficiary:

function addBeneficiary(address _beneficiary) external onlyOwner { require(!_isBeneficiary(_beneficiary), "Beneficiary already added"); // ✅ Prevents duplicates beneficiaries.push(_beneficiary); _setDeadline(); } function _isBeneficiary(address _beneficiary) internal view returns (bool) { for (uint256 i = 0; i < beneficiaries.length; i++) { if (beneficiaries[i] == _beneficiary) { return true; } } return false; }
Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.