Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

MembershipFactory::upgradeTier - when tokens are burnded/minted, the corresponding TierConfig.minted values are not updated

0xrs

Summary

Link: https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L155

The upgradeTier function allows to upgrade the tier level if the DAO is of type Sponsored. However, the the lower tier tokens are burned and the higher tier token is minted, the values for TierConfig.minted of the corresponding tier configuration are not updated. Also, for the higher tier, the new TierConfig.minted value needs to be verified and it must not be bigger than TierConfig.amount.

Vulnerability Details

Proof of Concept:

Add the following test to MembershipFactory.test.ts in the "Upgrade Tier" describe block:

it("TierConfig.minted is not updated when a Sponsored DAO membership is upgraded", async function () {
//provide & approve test tokens to user to purchase DAO membership
await testERC20.mint(addr1.address, ethers.utils.parseEther("1000"));
await testERC20.connect(addr1).approve(membershipFactory.address, ethers.utils.parseEther("1000"));
​
//user joins the Sponsored DAO at the lowest tier (tier 6) with 2 membership tokens
await membershipFactory.connect(addr1).joinDAO(membershipERC1155.address, 6);
await membershipFactory.connect(addr1).joinDAO(membershipERC1155.address, 6);
​
//at this stage, tier 6 should contain 2 and tier 5 should contain 0 membership tokens
expect((await membershipFactory.tiers(membershipERC1155.address))[6].minted).to.equal(2)
expect((await membershipFactory.tiers(membershipERC1155.address))[5].minted).to.equal(0)
​
//user upgrades from tier 6 to the next higher tier (tier 5)
await membershipFactory.connect(addr1).upgradeTier(membershipERC1155.address, 6);
​
//at this stage, tier 6 should contain 0 (2 tokens burned) and tier 5 should contain 1 membership token (1 token minted)
//however, tier 6 still contain 2 tokens and tier 5 contains 0 tokens
expect((await membershipFactory.tiers(membershipERC1155.address))[6].minted).to.equal(2)
expect((await membershipFactory.tiers(membershipERC1155.address))[5].minted).to.equal(0)
});

Impact

At a certain stage, one or more of the DAO tiers will have more members than specified in the configuration (TierConfig.amount). Also, thee maximum allowed number of members (DAOInputConfig.maxMembers) will be exceeded.

Tools Used

Manual Review

Recommendations

In the upgradeTier function, decrease the value of TierConfig.minted for the lower tier and increase the value of TierConfig.minted for the higher tier. Also, verify that TierConfig.minted does not exceed TierConfig.amount for the higher tier.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.