Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Rounding Error in Asset Distribution Leaves Residual Funds Locked

osuolale

Summary

Vulnerability Details

The withdrawInheritedFunds function contains a critical flaw in its asset distribution logic that permanently traps residual funds in the contract. The issue stems from:

uint256 amountPerBeneficiary = ethAmountAvailable / divisor; // or assetAmountAvailable/divisor
for (uint256 i = 0; i < divisor; i++) {
// Send amountPerBeneficiary to each
}
​
POC
Test Case:
​
Contract holds 101 wei ETH
​
3 beneficiaries exist
​
withdrawInheritedFunds() called
​
Result:
​
Each beneficiary receives 33 wei (33 × 3 = 99)
​
2 wei permanently stuck in contract

Key Issue:

  • Integer division truncates remainders (e.g., 101 wei ÷ 3 beneficiaries = 33 wei each, leaving 2 wei stranded)

  • No mechanism to handle residual amounts after equal division

Impact

  • Permanent Fund Loss: Residual amounts remain locked in contract forever

  • Accumulation Risk: Repeated distributions compound stranded funds

  • Protocol Leakage: Creates unrecoverable "dust" across all asset types (ETH/ERC20s)

Tools Used

Manual Review

Recommendations

Solution 1: Last Beneficiary Gets Residual

uint256 total = asset.balanceOf(address(this));
uint256 perBeneficiary = total / divisor;
uint256 residual = total - (perBeneficiary * divisor);
​
for (uint i; i < divisor; i++) {
uint256 amount = perBeneficiary;
if (i == divisor - 1) amount += residual;
// Send amount
}

Solution 2: Weighted Distribution (Advanced)

// Use proportional shares instead of equal division
uint256 totalShares = calculateTotalShares();
for (uint i; i < divisor; i++) {
uint256 share = (beneficiaryShares[i] * total) / totalShares;
// Send share
}

Solution 3: Full Amount Safety Check

require(
(perBeneficiary * divisor) == total,
"Amount must be exactly divisible"
);
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

truncation of integers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!