Inheritable Smart Contract Wallet

Summary

The buyer pays real money but receives no on-chain representation of what they purchased. This is not aligned with protocol promise of "manage estate planning, ensuring assets are distributed as intended without the need for intermediaries"

Vulnerability Details

1. After burning the NFT, there's no on-chain record that the buyer now owns the underlying asset

2. The system assumes off-chain processes will transfer the real-world asset to the buyer

3. There's no mechanism to verify a legitimate buyer actually received what they paid for

4. Even off-chain lack of events or storing mecanist of what asset has been bought by what legitimate player makes it hard to process.

Impact

If the real-world asset transfer fails, there's no on-chain recourse

No blockchain record links the payment to acquisition of the asset. State could be restored only with some serious investigations on the blocks.

Tools Used

manual review

Recommendations

1. Transfer the NFT to the buyer instead of burning it

2. Update NFT metadata to indicate it was bought out

3. Issue a receipt token or record the transaction in a mapping