Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

MemberShipFactory::upgradeTier() mints on the wrong tier index

y0ng0p3

Summary

The MemberShipFactory::upgradeTier function mints on fromTierIndex - 1 instead of fromTierIndex + 1.

Vulnerability Details

The MemberShipFactory::upgradeTier function allows users to upgrade their tier withing a sponsored DAO.

File: contracts/dao/MembershipFactory.sol#L155-L161
​
function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available."); /// @audit check for a tier higher than the given tier.
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1); /// @audit minting on the tier just lower than the given tier.
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

The second require statement suggests that the user upgrades to the tier just higher to the given tier. However, the mint function is called on the tier just lower the given tier, which lead to the user upgrading the wrong tier.

Impact

The user is upgrading the wrong tier.

Tools Used

Manual review.

Recommendations

File: contracts/dao/MembershipFactory.sol#L155-L161
​
function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
-- IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
++ IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex + 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!