Submission Details
Severity:
DAO members can evade membership token burning by frontrunning batch burn calls
Summary
DAO members with ERC1155 tokens can frontrun burnBatch() and burnBatchMultiple() calls to avoid having their tokens burned. They frontrun the call, and transfer all their tokens, which are about to be burned, to another address. This causes their balanceOf() to be zero for those tokens, and so burning is skipped.
Importantly, this "fails" silently without a revert, so the Admin may not notice that user's are circumventing the intended burning. If the admin finds out, they must manually burn them one by one.
Vulnerability Details
See Summary
Impact
See Summary
Tools Used
Manual Review
Recommendations
Unknown.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.