Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Deadline in `InheritanceManager.sol` isn't reset after multiple function calls, making the owner wallet appear inactive even with activity

uddercover

Summary

The inheritance manager has functionality to keep track of the owner wallet activity to adjust the timelock for distributing inheritance, but this functionality is not used in all the functions. This will cause the contract to not update the timelock duration and allow the `InheritanceManager::inherit` function to be called even when there is owner activity.

Vulnerability Details

In the InheritanceManager.sol contract , _setDeadline function is not called after createEstateNFT, removeBeneficiary and contractInteractions functions.

POC

Add this test to InheritanceManagerTest.t.sol

function testDeadlineIsntSetAfterFunctionCalls() public {
vm.prank(owner);
im.addBeneficiery(user1);
​
uint256 deadlineBefore = im.getDeadline();
assertEq(deadlineBefore, 90 days + block.timestamp);
​
vm.warp(80 days);
vm.startPrank(owner);
im.createEstateNFT("Never gonna give you up ;)", 1000 ether, address(usdc));
vm.stopPrank();
​
uint256 expectedDeadlineAfter = block.timestamp + 90 days; // should reset i.e 80 days + 90 days
uint256 actualDeadlineAfter = im.getDeadline();
​
assertEq(actualDeadlineAfter, deadlineBefore);
console.log("Expected Deadline After: ", expectedDeadlineAfter);
console.log("Actual Deadline After: ", actualDeadlineAfter);
}

Impact

The deadline would not be updated when the above functions are called, potentially causing the owner wallet to appear inactive, which would allow `inherit` to be called when it's not supposed to be.

Tools Used

manual review, foundry test suite

Recommendations

Add `_setDeadline()` at the end of all the target functions

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

functions do not reset the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.