Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

updateDAOMembership lacks validation for new tiers

octeezy

Summary

MembershipFactory::updateDAOMembership adds new tiers without validation for the minted value.

Vulnerability Details

When creating a new dao membership there is validation applied to the value for minted in MembershipFactory.sol#L86.

This validation is missing when adding a new tier to an existing dao membership, meaning it can be misconfigured.

PoC:

This test can be added to the "Update DAO Membership" section in test/MembershipFactory.test.ts

it("Should take in an incorrect minted configuration", async function () {
// Initial setup
const PoCDAOconfig = {
ensname: "PoC2.eth",
daoType: DAOType.GENERAL,
currency: testERC20.address,
maxMembers: 1120,
noOfTiers: 3
};
const PoCTierConfig = [
{ price: 6400, amount: 640, minted: 0, power: 64 },
{ price: 3200, amount: 320, minted: 0, power:32 },
{ price: 1600, amount: 160, minted: 0, power:16 }
];
await membershipFactory.createNewDAOMembership(PoCDAOconfig, PoCTierConfig);
const ensAddress = await membershipFactory.getENSAddress("PoC2.eth");
membershipERC1155 = await MembershipERC1155.attach(ensAddress);
​
// Setup config for new tier with a minted value greater than 0
const newTierConfig = [
{ price: 6400, amount: 640, minted: 0, power: 64 },
{ price: 3200, amount: 320, minted: 0, power:32 },
{ price: 1600, amount: 160, minted: 0, power:16 },
{ price: 1600, amount: 160, minted: 1000, power:16 }
];
​
// It successfully updates with values that shouldn't be valid
expect( await membershipFactory.updateDAOMembership("PoC2.eth", newTierConfig)).to.not.be.reverted;
});

Impact

Incorrect configuration can be set, disabling some functionality such as the ability to join the misconfigured tier.

Tools Used

manual review + hardhat tests

Recommendations

Add validation for new tiers on MembershipFactory.sol#L117.

for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
tierConfigs[i].minted = dao.tiers[i].minted;
- }
+ } else {
+ require(tierConfigs[i].minted == 0, "Invalid tier config");
+ }
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

octeezy Submitter
about 1 year ago
0xbrivan2 Lead Judge
about 1 year ago
octeezy Submitter
about 1 year ago
0xbrivan2 Lead Judge
about 1 year ago
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

minted value is not asserted to be zero when adding new tiers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!