Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of access control in InheritanceManager.sol::withdrawInheritedFunds() function can lead to distribute the asset call by anyone

ngochungp295

Summary

Lack of access control in InheritanceManager.sol::withdrawInheritedFunds() function. Anyone can call this function and then asset distribution will deploy.

Vulnerability Details

withdrawInheritedFunds() function can be called by anyone.That lead to transfer the asset to all beneficiary without reason. It should only be called by beneficiary .

Code detail:

@> function withdrawInheritedFunds(address _asset) external {
if (!isInherited) {
revert NotYetInherited();
}
uint256 divisor = beneficiaries.length;
if (_asset == address(0)) {
uint256 ethAmountAvailable = address(this).balance;
uint256 amountPerBeneficiary = ethAmountAvailable / divisor;
for (uint256 i = 0; i < divisor; i++) {
address payable beneficiary = payable(beneficiaries[i]);
(bool success,) = beneficiary.call{value: amountPerBeneficiary}("");
require(success, "something went wrong");
}
} else {
uint256 assetAmountAvailable = IERC20(_asset).balanceOf(address(this));
uint256 amountPerBeneficiary = assetAmountAvailable / divisor;
for (uint256 i = 0; i < divisor; i++) {
IERC20(_asset).safeTransfer(beneficiaries[i], amountPerBeneficiary);
}
}
}
​

Impact

Medium
Impact: Lack of access control that lead to transfer the asset to all beneficiary without reason. Fund or the asset don't lose in this case
Likelihood: high

Tools Used

Recommendations

Add modify for the function

function withdrawInheritedFunds(address _asset) external onlyBeneficiaryWithIsInherited{
//code
}

Updates

Lead Judging Commences

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.