Project

Summary

Currency decimal limits the maximum amount of token users can use to join a DAO.
DAO creator could create a new DAO with tier price too high that user can never be able to purchase the NFT using the DAO's currency.

Vulnerability Details

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L55-L94

The function MembershipFactory::createNewDAOMembership does not have validation for tier config price.

Impact

In case the DAO using USDC as currency which has 6 decimals, there could be a case the DAO creator using a value with 18 decimals for the tier's price.
This could lead to the scenario where users can not join the DAO because they don't have enough tokens to purchase the NFT.

Tools Used

Manual review.

Recommendations

Consider adding validation for the max value of tier's price when creating new DAO membership.