Project

Description

Let's take a look at updateDAOMembership function:

The problem is that this function doesn't verify if the new tier configurations' amount values are greater than or equal to the existing minted values. This could end up in to a situation where:

1. A tier already has some tokens minted

2. The DAO admin updates the tier configuration with a new amount that's less than the number of minted tokens

3. updateDAOMembership will allow this update, creating an invalid state where there are more minted tokens than the maximum allowed amount

Let's say we have a DAO with the following initial tier configuration:

Now, if someone calls updateDAOMembership with new tier configurations:

updateDAOMembership would allow this update, creating an invalid state where Tier 0 has 50 tokens minted but only allows 30 total. This breaks the fundamental invariant that minted <= amount

Recommendation

Consider to add a validation check before updating the tiers: