Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect tier upgrade logic leading to potential downgrade

tigerfrake

Summary

The upgradeTier() function in MembershipFactory is designed to allow users to upgrade their membership tier. However, the current logic erroneously decrements the fromTierIndex, causing users to potentially downgrade their tier

Vulnerability Details

The upgradeTier() function allows users to "upgrade" their membership by burning tokens from the current tier and minting tokens in a new tier.

---SNIP---
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);

The function decrements fromTierIndex by 1 to determine the new tier for minting. This logic effectively moves the user to a lower tier rather than upgrading them.

Impact

Users may unintentionally be moved to a lower tier, which contradicts the purpose of the upgradeTier() function.

Tools Used

Manual Review

Recommendations

Logic should be updated to correctly handle tier upgrades by incrementing the fromTierIndex.

---SNIP---
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
- IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
+ IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex + 1, 1);
- emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
+ emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex + 1);
Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!