The problem heres that the logic for tier upgrading is reversed. upgradeTier decrements the tier index (fromTierIndex - 1) when upgrading, but typically higher tier numbers should represent better tiers. This means users are actually "downgrading" instead of upgrading.
If a user is at tier 3 and wants to upgrade, upgradeTier burns their tier 3 tokens. Then mints them a token for tier 2 (fromTierIndex - 1). This is actually a downgrade, not an upgrade
In most protocols, higher tier numbers represent better/higher tiers. For eg:
- Tier 0: Bronze
- Tier 1: Silver
- Tier 2: Gold
- Tier 3: Platinum
Evidently by looking at the createNewDAOMembership function, tiers are stored in an array where index position matters. The joinDAO function uses tierIndex to determine which tier to mint. This suggests a natural progression where higher indices should represent better tiers
Users trying to "upgrade" are actually getting lower-tier memberships. This goes against the natural expectation of an upgrade system and as a rresult, users are losing value instead of gaining it.
This is particularly problematic for sponsored DAOs (note the check require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED))
The function requires exactly TIER_MAX tiers for sponsored DAOs (in createNewDAOMembership)
Consider reversing the logic accordingly
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.