Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Logic error in buyOutEstateNFT causes token loss

anchabadze

Description:

The buyOutEstateNFT() function contains a critical logic error that causes it to exit prematurely, resulting in potential token loss for users. The function first takes payment from the caller and then prematurely returns when it finds the caller in the beneficiary list:

function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited {
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
uint256 finalAmount = (value / divisor) * multiplier;
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount); // Caller pays tokens
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
return; // Early exit when caller is found
} else {
IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / divisor);
}
}
nft.burnEstate(_nftID); // Never executed due to early return
}

This function can only be called by a beneficiary due to the onlyBeneficiaryWithIsInherited modifier. However, the function always exits early when it finds the caller in the beneficiary list, preventing the completion of token distribution and NFT burning.

Impact:

Depending on the caller's position in the beneficiary array:

  • If the caller is the first beneficiary: No one receives tokens

  • If the caller is in the middle: Only beneficiaries before the caller receive tokens

NFT remains locked: The NFT is never burned since the function exits before reaching that code, effectively locking the NFT in the contract permanently. Core functionality broken: This is a fundamental feature of the inheritance system that is completely non-functional.

Recommended Mitigation:

Restructure the function to separate the token distribution logic from the caller identification

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

buyOutNFT has return instead of continue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.