Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Risk of Duplicate Beneficiaries in the addBeneficiary()

0xshaedyw

Summary

  • The addBeneficiary function in the provided code does not check if a beneficiary is already in the beneficiaries array before adding them.

Vulnerability Details

The addBeneficiary function allows the addition of a beneficiary without verifying whether the beneficiary is already present in the beneficiaries array. This can result in:

  • Duplicate Entries : The same beneficiary can be added multiple times, leading to repeated payouts.

function addBeneficiary(address _beneficiary) external onlyOwner {
// missing check
beneficiaries.push(_beneficiary);
_setDeadline();
}

Impact

  • Financial Losses : If the same beneficiary is added multiple times, they could receive payouts repeatedly, leading to financial losses for the contract.

Tools Used

  • Manual Code Review

Recommendations

Implement Duplicate Check :

  • Add a loop to check if _beneficiary is already in the beneficiaries array.

  • Use require to ensure that _beneficiary is not already present.

function addBeneficiary(address _beneficiary) external onlyOwner {
// Ensure the beneficiary is not already in the array
for (uint256 i = 0; i < beneficiaries.length; i++) {
require(beneficiaries[i] != _beneficiary, "Beneficiary already added");
}
​
// Ensure the beneficiary address is valid
require(_beneficiary != address(0), "Invalid beneficiary address");
​
// Add the beneficiary to the array
beneficiaries.push(_beneficiary);
​
// Set the deadline
_setDeadline();
}

Validate Beneficiary Address :

  • Ensure that _beneficiary is not the zero address (address(0)).

require(_beneficiary != address(0), "Invalid beneficiary address");
Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.