Submission Details
Severity:
The platform's fee can be equal to 0 when a user purchasing a membership.
Summary
The DAO Creator can set any tier price. If the tier price is less than 5 then the platform fee is 0
Vulnerability Details
When a user purchases a membership, the platform receives a fee of 20%
MembershipFactory::joinDAO
function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
...
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
...
}
If tierPrice < 5 then platformFees is 0
The tier price is set by the user creating the DAO MembershipFactory::createNewDAOMembership
Impact
If the DAO Creator sets the tier price less than 5, the platform will not receive a fee.
Tools Used
manual review
Recommendations
Сonsider adding ACCURACY or set min fee (example: platformFees = tierPrice < 5 ? minFee : (20 * tierPrice) / 100)
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.