Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Potential Underflow in Tier Upgrade Logic

harry_cryptodev

Summary

During the audit of the DAO membership contract, a critical issue was identified in the upgradeTier function. The code does not validate whether fromTierIndex is greater than zero before performing a decrement operation, which could lead to an underflow and unintended behavior.

Vulnerability Details

The following line in the upgradeTier function poses a risk:

IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);

Issue:

The code directly subtracts 1 from fromTierIndex without checking if fromTierIndex is greater than zero. If fromTierIndex is 0, this operation will result in an underflow, causing fromTierIndex - 1 to wrap around to a very large value (2^256 - 1), which can lead to unintended consequences.

Impact

If this vulnerability is exploited, it could lead to:

  • Incorrect Token Minting: Users may receive tokens for a non-existent or unintended tier.

  • Contract Integrity Issues: The logic of the DAO membership system could be compromised, leading to confusion and loss of trust among users.

Tools Used

Manual code review

Recommendations

require(fromTierIndex > 0, "Invalid tier index.");
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.