Project

Summary

As totalSupply becomes larger with the mint function using a big amount and a small tokenid in the MembershipERC1155 it contract may cause a loss in funds due to rounding down in the MembershipERC1155::sendProfit function, especially using USDC which uses 6 decimals for their arithmetic

Vulnerability Details

Integer division in this line may lead to the following problem:

let _totalsupply be type(uint256).max≈1e77 since there are no restrictions on how big the total supply can be, since ACCURACY is a constant of value 1e30 using the example of USDC token with 1 unit using 6 decimals 1e6 we arrive at the following expression:
(1e6*1e30)/1e77 = 1e-41 which would be rounded down to zero

Impact

This may lead to loss of funds due to rounding errors or an unusable DAO if the MembershipERC1155::totalSupply would be set to a number greater than approximately1e56

Tools Used

Manual review

Recommendations

Setting a sensible upper bound for amounts such as amount and totalSupply