Project

Vulnerability Details

updateDAOMembership#MembershipFactory with different tier size causes inconsistencies. When it is not a sponsored DAO, it is allowed to change the count of tierConfigs. When count of tiers is reduced, it can result in some messy calculations. Since loops are based on tierConfigs.length, the higher ones are ignored and are not accounted for maxMembers calculation. Also minted amounts are carried over which can get misalligned. This would cause minted parameters to be removed which would not be recovered by setting using the previous TierConfig

Recommendations

Force tierConfigs.length to be constant or make sure minted is zero for removed tiers.

If removing/adding tiers are intended, it might be nicer to have a seperate function to handle removing/adding tiers to be more consistent and avoid changing count of tiers in updateDAOMembership.