Summary

The createNewDAOMembership function in the MembershipFactory.sol contract contains an issue with the proxy initialization. If the initialize function in the proxy implementation (MembershipERC1155) is either missing or incorrectly defined, the proxy contract will fail to initialize, causing DAO creation to break.

Finding Description

In the createNewDAOMembership function, the contract creates a new TransparentUpgradeableProxy to deploy a DAO membership ERC1155 contract. This proxy is initialized with a constructor call:

If the initialize function is missing or incorrectly implemented in the MembershipERC1155 contract, the proxy deployment will fail, and the DAO creation will not be successful. This breaks the security guarantee of DAO creation and prevents the intended functionality of the contract.

This bug doesn't automatically trigger but can be exploited if the initialize function is not implemented or is faulty in the MembershipERC1155 contract. Malicious actors could potentially manipulate this function to create proxies that do not initialize properly, leading to the failure of DAO creation and a lack of governance functionality.

Vulnerability Details

The vulnerability stems from a missing or incorrectly implemented initialize function in the proxy contract (MembershipERC1155). If the initialize function is not available or doesn't match the expected signature, the proxy will fail during its initialization, resulting in a non-functional contract.

The specific issues that could arise include:

• The failure to set the correct state in the proxy, such as the ENS name, base URI, and currency.

• The potential for DAO creation to silently fail, with no indication that the DAO contract has not been properly initialized.

• Lack of proper checks for the success of the initialization function call.

Impact

The impact of this bug is high, as it prevents the successful creation and initialization of a DAO membership contract. This means:

• Users cannot join or interact with the DAO since the proxy is not initialized.

• Any governance mechanism relying on the proxy contract is rendered non-functional.

• The contract's fundamental purpose — to create and manage DAOs — is broken, leading to significant disruptions in its usage.

This directly undermines the contract’s intended functionality, and a failure to initialize the proxy means that DAO governance and membership management cannot occur.

Proof of Concept

1. Deploy the contract with a MembershipERC1155 implementation that lacks the initialize function.

2. Call the createNewDAOMembership function with valid parameters.

3. The function will execute without errors, but the proxy contract created will not be initialized correctly, causing it to be non-functional.

4. Any further interactions with the DAO (e.g., joining a tier or upgrading) will fail due to the uninitialized proxy.

Recommendations

To fix this issue, ensure that the MembershipERC1155 contract includes a properly defined initialize function that matches the expected signature and is called during the proxy initialization.

Here is an example of the corrected initialize function in MembershipERC1155:

This initialize function ensures that the proxy contract is properly set up with the required parameters (ensName, symbol, baseURI, admin, and currency).

Additionally, ensure that the proxy implementation (MembershipERC1155) includes the initializer modifier to prevent re-initialization:

By adding these changes, the proxy contract will initialize correctly, and the DAO creation will function as intended.

File Location: MembershipFactory.sol