Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing reentrancy protection in withdrawInheritedFunds allows DOS attack blocking inheritance distribution

anchabadze

Description:

The withdrawInheritedFunds() function in InheritanceManager contract lacks reentrancy protection, making it vulnerable to Denial of Service (DOS) attacks from malicious beneficiaries. The contract does have a nonReentrant` modifier, but it's incorrectly implemented and not applied to this critical function:

// Vulnerable function without reentrancy protection
function withdrawInheritedFunds(address _asset) external {
if (!isInherited) {
revert NotYetInherited();
}
uint256 divisor = beneficiaries.length;
if (_asset == address(0)) {
uint256 ethAmountAvailable = address(this).balance;
uint256 amountPerBeneficiary = ethAmountAvailable / divisor;
for (uint256 i = 0; i < divisor; i++) {
address payable beneficiary = payable(beneficiaries[i]);
(bool success,) = beneficiary.call{value: amountPerBeneficiary}("");
require(success, "something went wrong");
}
} else {
// ERC20 token distribution code...
}
}

The function iterates through beneficiaries and makes external calls to each one when distributing ETH. Since these calls are made before completing the function, a malicious contract as a beneficiary can launch a DOS attack by consuming all gas in its receive() function, causing the entire transaction to fail.

Impact:

A malicious beneficiary can prevent ANY distribution of assets to legitimate beneficiaries by making the transaction revert. Permanent denial of service: Since the list of beneficiaries cannot be modified after inheritance is activated (isInherited = true), a single malicious actor can permanently block the core functionality of the contract. The primary purpose of this contract (asset inheritance) becomes impossible to fulfill.

Recommended Mitigation:

Apply the nonReentrant modifier. But first you need to fix the existing nonReentrant modifier, because in the current implementation it's broke

Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!