Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Adding Invalid Beneficiary (address(0))

viktoronweb3

Summary

The InheritanceManager contract's addBeneficiery() function does not validate the _beneficiary address, allowing the owner to add address(0) as a beneficiary. This can lead to funds being sent to address(0) during withdrawInheritedFunds(), effectively burning ETH or ERC20 tokens and causing a loss of funds for legitimate beneficiaries.

Vulnerability Details

The function lacks validation to ensure that _beneficiary is not address(0). It also does not check for duplicates, but the primary concern here is the zero address.

When address(0) is added to the beneficiaries array, it is treated as a valid beneficiary. Later, when withdrawInheritedFunds() is called after inheritance, the function attempts to distribute funds equally among all beneficiaries, including address(0).

Impact

There is loss of funds by burning them to the 0 address.

Tools Used

Manual review.

Recommendations

Add input validation.

Proof of concept :

```solidity

​
function testPocAddInvalidBeneficiary() public {
// Step 1: Add address(0) as a beneficiary
vm.startPrank(owner);
im.addBeneficiery(address(0));
im.addBeneficiery(user1);
vm.stopPrank();
​
// Step 2: Fund the contract and enable inheritance
vm.deal(address(im), 6 ether);
vm.warp(1 + 90 days);
vm.startPrank(user1);
im.inherit();
​
// Step 3: Withdraw funds
// it withdraws funds to the address(0)
console.log(address(0).balance); // it has 0 ether
im.withdrawInheritedFunds(address(0));
console.log(address(0).balance); // it has 3 ether
vm.stopPrank();
}

```

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.