Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Blacklisted USDC/USDT beneficiary permanently locks all token distribution

anchabadze

Description:

The InheritanceManager::withdrawInheritedFunds() function distributes tokens to all beneficiaries in a single transaction. If any beneficiary's address is blacklisted by centralized tokens like USDC or USDT, the entire distribution operation will fail, permanently locking those tokens in the contract.

function withdrawInheritedFunds(address _asset) external {
if (!isInherited) {
revert NotYetInherited();
}
uint256 divisor = beneficiaries.length;
if (_asset == address(0)) {
// ETH distribution logic
// ...
} else {
uint256 assetAmountAvailable = IERC20(_asset).balanceOf(address(this));
uint256 amountPerBeneficiary = assetAmountAvailable / divisor;
for (uint256 i = 0; i < divisor; i++) {
IERC20(_asset).safeTransfer(beneficiaries[i], amountPerBeneficiary); // Will revert if any address is blacklisted
}
}
}

Centralized stablecoins like USDC and USDT implement blacklisting functionality where transfers to certain addresses are blocked. When safeTransfer attempts to send tokens to a blacklisted address, the entire transaction reverts.

The issue is particularly severe because:

  • Once the inheritance mode is activated (isInherited = true), there's no way to modify the list of beneficiaries

  • There's no alternative distribution mechanism available

  • The function loops through all beneficiaries in a single transaction

Impact:

If any beneficiary address becomes blacklisted by USDC/USDT, those tokens will be permanently locked in the contract with no recovery mechanism. Even non-blacklisted beneficiaries cannot receive their share of the blacklisted tokens.

Recommended Mitigation:

Implement a pull-based withdrawal pattern instead of the current push-based approach

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.