Project

Summary

The MembershipFactory contract allows the creation of decentralized autonomous organizations (DAOs) with tiered membership structures using ERC1155 tokens. However, it contains a vulnerability in its createNewDAOMembership function that could allow a malicious actor to configure a DAO in a way that unfairly captures profits intended for other members. By strategically setting tier prices, a bad actor can economically dominate profit distribution mechanisms within a DAO, effectively creating a honeypot scenario.

Vulnerability Details

The vulnerability exists because the createNewDAOMembership allows any user to create a DAO with arbitrary tier configurations, including setting the price and power level for each tier. The ERC1155 tier structure uses power levels to determine profit shares, with each tier having a distinct weight. In this setup, the power of a tier is directly tied to profit distribution, where tier 0 has the highest weight.

A malicious user can:

• Configure the DAO with 7 tiers, setting tier 0 to have the highest possible power (64) and the smallest possible price (1 wei).

• Rapidly purchase all available slots in this tier, exploiting the low price to effectively capture the maximum share of all future profits with minimal initial investment.

• As a consequence, all incoming profits sent to the DAO are overwhelmingly directed to the bad actor due to tier 0's disproportionate share of rewards.

Impact

The primary impact of this vulnerability is financial:

• For New Members: Genuine participants entering the DAO post-creation may find their investments in higher tiers yielding negligible returns, resulting in a significant imbalance of expected versus actual rewards.

• For the Platform: The business model may be compromised if fees from transactions (intended as a percentage of tier prices) are rounded down to zero during low-value transactions, as demonstrated in this setup.

POC

1. Contract Setup:

   • A CurrencyManager contract is deployed to manage accepted currencies.

   • A MembershipERC1155 contract is deployed and used as the implementation for membership tokens.

   • A MembershipFactory contract is instantiated, managing the creation of DAOs.

2. DAO Configuration:

   • A DAO, named testdao.eth, is initialized with seven tiers. Tier 0 is configured with a high power rating of 64 and an extremely low price of 1 wei, while the subsequent tiers are configured with decreasing power ratings and increasing prices.

3. Attack Execution:

   • The attacker mints sufficient tokens to fully purchase all available slots in tier 0, costing a negligible amount due to the low price setting.

   • The attacker's address subsequently holds 500 tokens in the most powerful tier, achieving a higher "influence" over profit distributions.

LOGS

• Tier 0 minted amount after join: Confirms that all 500 available slots in tier 0 have been purchased by the attacker.

• DAO Membership token Balance: Shows the balance of the DAO contract in terms of ERC20 tokens, reflecting successful payment for tier memberships (though minimal).

• Total Supply: Indicates the cumulative power weighting across all tiers—achieving an inflated level due to the attacker’s actions.

Tools Used

Foundry

Recommendations

Implement a minimum threshold for tier prices to prevent the creation of tiers that can be purchased at negligible cost. This threshold would ensure a baseline cost to deter such exploitative behavior.