Submission Details
Severity:
Using name instead of important parameter when `createNewDAOMembership` may cause DOS
Summary
When createNewDAOMembership, you should use important parameters to check if the same DAO membership has been created. If you only check by name, it may cause DOs
Vulnerability Details
An attacker can prevent the creation of any dao membership by front-running a transaction to submit a DAO membership with the same daoConfig.ensname, resulting in createNewDAOMembership DOS.
function createNewDAOMembership(DAOInputConfig calldata daoConfig, TierConfig[] calldata tierConfigs)
external returns (address) {
require(currencyManager.isCurrencyWhitelisted(daoConfig.currency), "Currency not accepted.");
require(daoConfig.noOfTiers == tierConfigs.length, "Invalid tier input.");
require(daoConfig.noOfTiers > 0 && daoConfig.noOfTiers <= TIER_MAX, "Invalid tier count.");
require(getENSAddress[daoConfig.ensname] == address(0), "DAO already exist.");
//......
Impact
Ordinary users cannot create DAO membership normally
Tools Used
Manual review
Recommendations
When createNewDAOMembership, you should use important parameters to check if the same DAO membership has been created.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.