Summary

Due to role assignment limitations, certain MembershipERC1155 functions and role-management features are unreachable, preventing full utilization of the contract.

Vulnerability Details

In MembershipERC1155, roles are assigned during initialization as follows:

The msg.sender here is MembershipFactory, which creates MembershipERC1155 through createNewDAOMembership.

The MembershipFactory serves as the entry point for users to mint and burn tokens, requiring the OWP_FACTORY_ROLE role, as shown below:

However, functions such as burnBatch, burnBatchMultiple, and callExternalContract also require OWP_FACTORY_ROLE, but they cannot be accessed or called through MembershipFactory. Additionally, role-management functions, such as those associated with DEFAULT_ADMIN_ROLE, remain inaccessible, as they require this role to manage permissions, which is exclusively assigned to MembershipFactory. This results in limited functionality for MembershipERC1155 as certain actions cannot be performed.

Impact

Functions like burnBatch, burnBatchMultiple, callExternalContract, and role-management functionalities in MembershipERC1155 are effectively unreachable, resulting in incomplete contract functionality and restricting necessary role-management operations.

Tools Used

Manual

Recommendations

Reevaluate the design and integration between MembershipFactory and MembershipERC1155 to ensure that the intended functionalities and role management operations can be accessed and executed.