Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

A USDC blacklisted user can not join DAO using USDC as currency

0xmusashi

Summary

The MembershipFactory contract allows a user to join a DAO by purchasing a membership NFT at a specific tier. In case the currency of the MembershipERC1155 contract is USDC and the user or the MembershipFactory::owpWallet is blacklisted by USDC token, this user cannot join the DAO.

Vulnerability Details

The MembershipFactory contract allows a user to join a DAO by calling the MembershipERC1155::claimProfit() function:
https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L140-L150

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(
daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted,
"Tier full."
);
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(
_msgSender(), daoMembershipAddress, tierPrice - platformFees
);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

When MembershipERC1155::currency is USDC, and the caller (or daoMembershipAddress or owpWallet is blacklisted), the caller cannot join the DAO.

Impact

USDC blacklisted users can join a DAO which uses USDC as its currency, leading to bad user experience.

Tools Used

Manual review.

Recommendations

Using another stablecoin without blacklisted feature.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.