Summary

MembershipERC1155 inherits from ERC1155Upgradeable and AccessControlUpgradeable
https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/tokens/MembershipERC1155.sol#L13

Looking at the following function:

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/tokens/MembershipERC1155.sol#L135

If the interfaceId does not match type IMembershipERC1155, the function proceeds to call supportsInterface() by invoking the super keyword. Since AccessControlUpgradeable is the more derived contract, it will call supportsInterface on the AccessControlUpgradeable contract.

The supportsInterface() function of AccessControlUpgradeable checks if the interfaceId matches IAccessControl, otherwise it will again proceed to call supportsInterface() invoking the super keyword.

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/access/AccessControlUpgradeable.sol#L90

AccessControlUpgradeable inherits ERC165Upgradeable, so it will call the supportsInterface() function for that contract:

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/utils/introspection/ERC165Upgradeable.sol#L30-L32

We can see that the supportsInterface() function is never invoked for ERC1155Upgradeable, therefore the following function is never called:

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/token/ERC1155/ERC1155Upgradeable.sol#L58

Note that this issue also applies to OWPIdentity.sol, where the supports interface of AccessControl not called (since ERC1155Supply inherits ERC1155, it will call that first) https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/OWPIdentity.sol#L104

Impact

The contract is meant to be a strict implementation of ERC1155, but it does not implement the mandatory ERC1155.supportsInterface() function.

Protocols that integrate with The One World Project may assume that it is ERC1155 compliant and users may incorrectly assume that IERC1155 or IERC1155MetadataURI interfaces are not supported, which can lead to a range of issues for relevant parties. This will also damage the brand of the protocol and limit market growth.

Reference

Here is a similar issue from a past contest: https://github.com/sherlock-audit/2024-04-titles-judging/issues/287

Recommendations

Ensure that supportsInterface() is also called for ERC1155Upgradeable within MembershipERC1155. Apply the following changes to MembershipERC1155, and consider making similar changes to OWPIdentity.sol