Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

MembershipFactory::joinDAO - tier fees are transferred to the DAO creator, but the DAO creator cannot retrieve those fees

0xrs

Summary

Link: https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L147

Each time a member joins a DAO, the creator gets some fees:

IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);

However, there is no way for the DAO owner to retrieve those fees, because the contract is lacking a withdraw function.

Vulnerability Details

Some details...

Proof of Concept:

Add the following test to MembershipFactory.test.ts in the "Join DAO" describe block:

it("DAO creator cannot withdraw fees", async function () {
//addr1 joins the DAO at the lowes level (2) and pays the fee
await testERC20.mint(addr1.address, ethers.utils.parseEther("100"));
await testERC20.connect(addr1).approve(membershipFactory.address, ethers.utils.parseEther("100"));
await membershipFactory.connect(addr1).joinDAO(membershipERC1155.address, 2);
//the DAO contains the correct balance: 100 - 20% protocol fee = 80
expect(await testERC20.balanceOf(membershipERC1155.address)).to.equal(80);
​
//the DAO creator still holds the original balance: 100 - 80 = 20
expect(await testERC20.balanceOf(owner.address)).to.equal(20);
//only the protocol owner can withdraw the fees for the DAO creator using callExternalContract
const calldataTransfer = testERC20.interface.encodeFunctionData("transfer", [owner.address, 80]);
const encodedCalldata = membershipERC1155.interface.encodeFunctionData("callExternalContract", [testERC20.address, calldataTransfer]);
await membershipFactory.callExternalContract(membershipERC1155.address, encodedCalldata);
//now, the DAO creator received the fees - the new balance is: 20 + 80 = 100
expect(await testERC20.balanceOf(owner.address)).to.equal(100);
});

Impact

THe DAO creator cannot withdraw accrued fees.

Tools Used

Manual Review

Recommendations

Add a withdraw function that allows the DAO creator to withdraw accrued fees.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.