Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing KYC and NFT Ownership Verification for Ecosystem Access

jesjupyter

Summary

The lack of contract-level KYC and NFT verification allows unverified users to interact with restricted features, bypassing the platform’s intended access controls. Adding these verifications at the contract level would reinforce secure access control.

Vulnerability Details

According to OneWorldProject’s website, to participate in the ecosystem, users must complete KYC and purchase an NFT membership.

However, current functions like createNewDAOMembership and joinDAO lack contract-level checks for either KYC verification or NFT ownership.

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

This omission allows non-KYC-verified users to interact with the ecosystem, relying on front-end restrictions that are insufficient for robust access control.

Impact

Without contract-level KYC and NFT verification, unverified users may bypass front-end checks and access restricted features within the ecosystem. This exposes the system to regulatory risks and potential unauthorized access.

Tools Used

Manual

Recommendations

Implement KYC and NFT ownership verification within the smart contracts, ensuring that access control requirements are enforced at the protocol level.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

jesjupyter Submitter
about 1 year ago
jesjupyter Submitter
about 1 year ago
0xbrivan2 Lead Judge
about 1 year ago
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

KYC is not checked when creating or joining DAOs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!