Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Inconsistent Tracking of Minted NFTs in `upgradeTier` Function

jesjupyter

Summary

The minted count is not updated during tier upgrades, risking a breach of the allowed amount for a given tier, which undermines the DAO’s design.

Vulnerability Details

The minted variable in daos[daoMembershipAddress].tiers[tierIndex] is intended to track the number of NFTs minted for each tier to ensure it does not exceed the set amount. This is enforced in the joinDAO function:

require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");

However, in the upgradeTier function, when a user burns two NFTs of fromTierIndex - 1 and mints one NFT for fromTierIndex, the minted count is not updated accordingly:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

This lack of synchronization between the minted count and the actual NFT supply results in an inconsistency with the intended design. Consequently, the minted amount can exceed the set amount for a given tier, breaking the intended restrictions of the DAO structure.

Impact

The inconsistency in tracking minted NFTs can result in the minted amount exceeding the tier’s allowed amount, potentially disrupting the DAO’s intended tier limits and restrictions.

Tools Used

Manual

Recommendations

Update the minted count within the upgradeTier function to reflect the actual NFT supply and maintain consistency with the DAO’s design requirements.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.