Project

Summary

This vulnerability allows an attacker to preemptively submit a DAO proposal with the same name as daoConfig.ensnamed submitted by a normal user, which will cause the user to be unable to submit the DAO proposal normally. The root cause of this vulnerability is that only the name of "daoConfig.ensnamed is checked, and other important parameters are not checked.

Vulnerability Details

The attacker can preemptively create a DAO membership with the same name, causing the DAO membership created by ordinary users to be reverted.

//MembershipFactory.sol

require(getENSAddress[daoConfig.ensname] == address(0), "DAO already exist.");

Impact

Users cannot submit proposals normally, and attackers can set malicious parameters to submit proposals.

Recommendations

Manual review.

Set a hash value for important parameters such as daoConfig.ensname, daoConfig.daoType, daoConfig.currency, daoConfig.maxMembers, daoConfig.noOfTiers as daoConfig.ensname of DAO for checking.