Project

Summary

when burning tiered tokens, `daos[daoMembershipAddress].tiers[tierIndex].minted` is not updated. This means that this mapping remains it's minted value which does not represents the actual circulating supply. This leads to fever users being able to mint a specific tier.

Vulnerability Details

When joining a DAO, `daos[daoMembershipAddress].tiers[tierIndex].amount` is checked not to exceed `daos[daoMembershipAddress].tiers[tierIndex].minted`.

This .minted value is incremented everytime someone joins the DAO. When burning a token via upgradeTieror external call, the mapping is not updated. This means that the .minted value does not represent the totalSupply of the specific tier token.

What will happen is:

1. Tokens will be minted up to the .amount value which it can not exceed

2. Tokens will be burned via upgradeTier or an external burn call which decreases the supply

3. joinDAO will continue to fail although a x amount of minted tokens have been burned.

Impact

Joining a DAO will become unavailable for all tiers, except for tier 0, while not meeting the max criteria

Tools Used

manual review

Recommendations

include a decrement of .minted tokens every time a specific tier token gets burned