Inheritable Smart Contract Wallet

Summary

The InheritanceManager contract allows beneficiaries to buy out NFTs at their recorded value in the nftValue mapping. However, if a trustee fails to explicitly set a value for an NFT, the default value of 0 is used, enabling an attacker to acquire valuable assets for free.

Vulnerability Details

When an NFT is created through the createEstateNFT function, the value is stored in the nftValue mapping. However, if the trustee never calls setNftValue for a particular NFT, or if a new NFT is created after inheritance, its value in the mapping remains at the default of 0:

Impact

A malicious beneficiary pays nothing (0 tokens) but gains ownership of the real-world asset represented by the NFT.

Theft of Valuable Assets

Violation of Fair Distribution

Tools Used

Recommendations

• min value checks

• adding some valuyations process like hasBeenValued[_index] = true;