Project

Summary

The protocol's intention is to not allow anyone to create or join DAOs without first completing the KYC process.

OWPIdentity.sol is an identity contract with the purpose of storing KYC information on users before they can create or join a DAO, but the state of this contract isn't utilized to prevent creating or join DAOs in MembershipFactory.sol.

Vulnerability Details

MembershipFactory::createNewDAOMembership should check to make sure msg.sender owns an OWPIdentity NFT, but it doesn't.

MembershipFactory::joinDAO should check to make sure msg.sender owns an OWPIdentity NFT, but it doesn't.

Impact

You can bypass the front end KYC process and still create a join DAOs by directly calling the functions in MembershipFactory.

Tools Used

Manual review

Recommendations

Check to make sure the caller of createNewDAOMembership and joinDAO have the KYC NFT, otherwise revert.