Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

It is possible to create/update a DAO with empty tiers config.

crmx_lom

Summary

When creating a DAO, you can pass an empty tiers config to MembershipFactory::createNewDAOMembership function.

There are no checks. The user can create a DAO with empty tiers, which will improper the business logic flow.

function createNewDAOMembership(DAOInputConfig calldata daoConfig, TierConfig[] calldata tierConfigs)
external
returns (address)
{
...
for (uint256 i = 0; i < tierConfigs.length; i++) {
require(tierConfigs[i].minted == 0, "Invalid tier config");
dao.tiers.push(tierConfigs[i]);
}
...
}

The same issue affects MembershipFactory::updateDAOMembership function.

Vulnerability Details

PoC(foundry):

pragma solidity ^0.8.0;
​
import {Test, console} from "forge-std/Test.sol";
import {MembershipFactory} from "../contracts/dao/MembershipFactory.sol";
import {DAOInputConfig, TierConfig, DAOType} from "../contracts/dao/libraries/MembershipDAOStructs.sol";
import {CurrencyManager} from "../contracts/dao/CurrencyManager.sol";
import {MembershipERC1155} from "../contracts/dao/tokens/MembershipERC1155.sol";
​
contract MembershipFactoryTest is Test {
​
MembershipFactory public factory;
CurrencyManager public currencyManager;
MembershipERC1155 public membershipImplementation;
​
function setUp() public {
currencyManager = new CurrencyManager();
address _owpWallet = address(0);
string memory _baseURI = "https://baseuri.com/";
membershipImplementation = new MembershipERC1155();
factory = new MembershipFactory(address(currencyManager), _owpWallet, _baseURI, address(membershipImplementation));
}
​
function test_createDAOMembership() public {
currencyManager.addCurrency(address(1));
DAOInputConfig memory daoConfig = DAOInputConfig({
ensname: "testdao.eth",
daoType: DAOType.PUBLIC,
currency: address(1),
maxMembers: 0,
noOfTiers: 1});
TierConfig[] memory tierConfig = new TierConfig[]();
​
address membershipNftAddress = factory.createNewDAOMembership(daoConfig, tierConfig);
console.log("membershipNftAddress: %s", membershipNftAddress);
assertTrue(membershipNftAddress != address(0x00));
}
​
}

Impact

A DAO with empty tiers makes improper the business logic flow

Tools Used

Manual review

Recommendations

Add a check for tiers config

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.