Project

Summary

A front-running vulnerability in the createNewDAOMembership function of the MembershipFactory contract can allow a malicious user to prevent other users from creating new DAOs by continually front-running transactions. This vulnerability was identified previously, but the impact was assessed only as the potential for “stealing” DAO names (base on protocol response). However, the issue is much more severe, as an attacker could completely block all DAO creations, resulting in a Denial of Service (DoS) for all users.

References

• MembershipFactory.sol on GitHub

Vulnerability Details

The createNewDAOMembership function checks if a DAO with the same ensname already exists, reverting the transaction if it does. This design flaw enables an attacker to submit a transaction with the same ensname and a higher gasPrice, allowing them to front-run any legitimate attempts to create a DAO with that name. If executed repeatedly, this results in a DoS condition where legitimate users are blocked from creating new DAOs with any desired name, as the attacker monopolizes each name with front-running transactions.

This vulnerability was previously identified, but the impact was not fully understood. The original assessment by the project team described it only as the risk of "stealing" DAO names. However, the true impact is much broader: an attacker could indefinitely block all DAO creation by monopolizing the naming mechanism, effectively halting the core functionality of the DAO creation process on the platform.

The code snippet from the createNewDAOMembership method is shown below:

Impact Details

1. Denial of Service (DoS) on DAO Creation: A malicious actor can block all DAO creation attempts by front-running transactions and claiming each DAO name, making it impossible for legitimate users to proceed.

2. Gas Wastage for Users: Users who attempt to create DAOs will incur gas costs for transactions that get reverted due to the name conflict created by the attacker.

This can severely impact user experience and the core functionality of the protocol by blocking legitimate users from establishing new DAOs.

Proof of Concept (POC)

The following test demonstrates how a front-running attack could exploit this vulnerability to block DAO creation:

Add the code to test/MembershipFactory.test.ts:

To run the test, use the following command:

Sample test output:

Recommendation

To mitigate this issue, it’s recommended to dynamically generate the ensname using a hash that incorporates a unique identifier such as the sender's address. This would prevent attackers from predicting or duplicating the same ensname to front-run transactions.