Project

Summary

Users are required to pay tokens as platform fees when joining the DAO, with each tier having its own price.

However, when a user wants to upgrade to a different tier, the contract should adjust the token amount accordingly based on the price of the new tier. Currently, this logic is not implemented in the upgradeTier() function

Vulnerability Details

joinDAO()

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L146

No tokens transfer in upgradeTier - upgradeTier()

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L155

Impact

The user may choose a lower-priced tier to join the DAO initially and then upgrade to a higher tier later at no additional cost

Tools Used

Manul review

Recommendations

When a user upgrades, adjust the tokens they paid accordingly, transferring or refunding any excess tokens to or from the user based on the price of the upgraded tier