Inheritable Smart Contract Wallet

Vulnerability Details

If address(0) is passed to withdrawInheritedFunds the contract will distribute the available ETH to beneficiaries, for this we are using .call() method, if the beneficairy address is a smart contract he can gain control flow in receive funciton and can renter the withdrawInheritedFunds function.

Impact

I don't think attacker would be able to steal funds here, because outside the for loop we are caching amountPerBeneficiary, this means if attacker gains more funds than what he his entitled to, there will not be enough funds for other benefeciaries and the function will ultimately revert.
But just to be safe we can put nonRdentrant modifier on the function.

Tools Used

Manual Review

Recommendations

Add nonReentrant modifier to withdrawInheritedFunds