Summary

User may join a DAO tier with unexpected power due to a lack of validation.

Vulnerability Details

Each tier in a DAO has different power, users may choose to join different tiers because of the different power configuration. At the same time, the tiers can be updated through updateDAOMembership() and so is the power configuration.

Because there is no pause functionality to prevent users from joining a DAO when the DAO tiers are to be updated, therefore it's possible that before a user's join transaction is actually executed, the DAO tiers are updated and it would result in user joining a tier with unexpected power. Things would be more so when user sign a meta transaction, the relayer may not be able to execute the transaction on behalf of the user in time (a malicious relayer may intend to do so).

Impact

Use pays to join a DAO tier but the power is unexpected, user's funds are wasted.

Tools Used

Manual Review

Recommendations

It is recommended to check if the tier power is the same as expected.