Project

Summary

The joinDAO function lacks validation to check whether a user already holds a membership in a specific tier of a DAO. This omission allows users to purchase multiple memberships in the same tier, which may not align with the intended business logic and could lead to potential abuse of membership privileges and disruption of the DAO's tier structure.

Vulnerability Details

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L140

Issue Explanation:

• No Membership Check: Users can call joinDAO multiple times for the same tier, obtaining additional membership tokens.

• Business Logic Violation: The DAO may intend for users to hold only one membership per tier.

Impact

Tools Used

Manual Code Review

Recommendations
Implement Membership Tracking:

mapping(address => mapping(uint256 => mapping(address => bool))) public userMemberships;

• Add Validation in joinDAO:

  require(!userMemberships[daoMembershipAddress][tierIndex][_msgSender()], "Already a member of this tier.");

• Define Business Logic Clearly:

  Specify membership rules and communicate them to users.