Project

Summary

In the updateDAOMembership function, modifying the tier configuration to reduce the number of tiers can lead to unintended access and reward issues for users who hold NFTs from eliminated tiers. Additionally, data continuity is impacted, as minted values from the removed tiers are lost, which can break the historical tracking of memberships and disrupt other functionalities that depend on a stable tier structure.

Vulnerability Details

When tiers are removed through the updateDAOMembership function, the following issues arise:

1. Access and Rewards: Users with NFTs from removed tiers may still be able to claim rewards or benefits, despite their tier no longer being officially supported. This creates a mismatch between the DAO’s current tier structure and the benefits being claimed, potentially causing operational inconsistencies.

2. Data Continuity Loss: Any minted values for the removed tiers are permanently deleted, breaking continuity in membership tracking and leading to data gaps. This loss of data can disrupt the historical integrity of the DAO's membership records.

While holders of eliminated tiers may still claim rewards, the factory contract fails to accurately track and validate these data, compromising the reliability of the DAO’s member history.

Removing tiers without retaining data on minted NFTs can lead to misleading information in the contract. If a tier is removed and later reintroduced, the minted count may incorrectly reset to zero, despite NFTs having previously been issued. This discrepancy can result in inaccurate member tracking, potentially allowing users to claim benefits or rewards erroneously and causing issues in DAO membership verification and governance continuity.

Impact

The impact of this vulnerability includes:

1. Operational Inconsistency: Users with NFTs from removed tiers may continue claiming rewards, causing confusion and possible dissatisfaction among DAO members.

2. Financial Impact: The DAO may incur additional expenses by distributing rewards to holders of NFTs from inactive tiers.

3. Exceeding Minted Limits: When tiers are eliminated and new tiers are added afterward, the data on previously minted NFTs is lost. This can lead to a situation where more NFTs have been minted than the current tier structure allows, as the minted count for removed tiers resets to zero. Consequently, the DAO could have more minted units than the allowed maximum.

Tools Used

• Hardhat

Recommendations

1. Validation Checks: Implement validation within the reward-claiming functions to prevent claims from NFTs associated with removed tiers.

2. Data Migration: Introduce a process to either transfer or nullify NFTs from eliminated tiers, ensuring users are mapped to active tiers if possible.

3. Restrict Tier Reduction with Active Minted IDs: Introduce a restriction in the updateDAOMembership function to prevent reducing the number of tiers when there are already minted IDs associated with those tiers. This safeguard ensures continuity in membership tracking and prevents potential issues with data validation and reward claiming for existing members.

4. Preserve Minted Data for Removed Tiers: Ensure that data related to already minted NFTs is retained, even if a tier is removed, to prevent data inconsistencies. This approach avoids scenarios where re-adding tiers might incorrectly reset minted counts to zero, ensuring accurate tracking and reducing potential errors in member rewards and verification.