Project

Summary

upgradeTier() method allows users to upgrade their tiers within a sponsored DAO. However any users holding odd numbers of tokens may left with unupgradable token due to the implementation of the function.

Vulnerability Details

The upgradeTier() function is defined as:

as it can be seen from both the inline commment and the code, the function is supposed to upgrade the tierIndex that user passed in. However any user holding odd number of tokens may potentially ended up with an unupgradable token due to the constraint in the burn function. In the code, an upgrade is only allowed by burning 2 token from the lower tier . Imagine the following scenario:

1. Bob starts with 7 tokens at tierIndex=5.

2. First upgrade call: Burns 2 tokens at tierIndex=5 and gives Bob 1 token at tierIndex=4. Remaining tokens at tierIndex=5: 5.

3. Second upgrade call: Burns 2 more tokens at tierIndex=5 and gives another token at tierIndex=4. Remaining tokens at tierIndex=5: 3.

4. Third upgrade call: Burns 2 more tokens at tierIndex=5 and gives a third token at tierIndex=4. Remaining tokens at tierIndex=5: 1.
   After these upgrades:
   • Bob has 3 tokens at tierIndex=4 (from upgrading) but 1 token left at tierIndex=5.
   • This 1 remaining token at tierIndex=5 can’t be upgraded on its own because it doesn’t meet the burn 2 tokens requirement.

if Bob attempts to mint an additional token to meet the upgrade requirement, he may face another constraint: if the minted count for that specific tier has already reached the maximum amount allowed, Bob would be unable to mint any additional tokens. This would leave him without a way to fulfill the upgrade requirement, making his leftover token permanently "stranded."

Impact

Users holding odd numbers of tokens will ended up with a token that is not upgradable, Leaving the system with unupgradable tokens from different lower tiers

Tools Used

Manual review

Recommendations

Implement a way allowing users to upgrade the left-over tokens