Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Use of msg.sender Instead of _msgSender()

calc1f4r

Summary

The MembershipFactory contract inherits from NativeMetaTransaction, which provides an overridden _msgSender() function to correctly handle meta-transactions. However, in the current implementation, there are instances where msg.sender is used directly instead of _msgSender(). This can lead to inconsistencies in identifying the actual sender, especially when interacting through meta-transactions or proxy contracts.

function claimProfit() external returns (uint256 profit) {
profit = saveProfit(msg.sender);
require(profit > 0, "No profit available");
savedProfit[msg.sender] = 0;
IERC20(currency).safeTransfer(msg.sender, profit);
emit Claim(msg.sender, profit);
}
function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
} else {
IERC20(currency).safeTransferFrom(msg.sender, creator, amount); // Redirect profit to creator if no supply
}
}
function initialize(
string memory name_,
string memory symbol_,
// this is baseuri
string memory uri_,
address creator_,
address currency_
) external initializer {
_name = name_;
_symbol = symbol_;
creator = creator_;
currency = currency_;
_setURI(uri_);
​
// @audit-issue -> Should it not be _msg.sender?
/// Should it not be _msg.sender?
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(DAO_CREATOR, creator_);
_grantRole(OWP_FACTORY_ROLE, msg.sender);
}
​

Recommendation
Replace msg.sender with _msgSender(): Update all instances where msg.sender is used to _msgSender() to ensure that the sender is correctly identified in all contexts.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!