Project

Summary

A critical design vulnerability exists in the MembershipFactory's joinDAO function due to the absence of per-address membership limits. This enables users with sufficient capital to purchase all available memberships in crucial tiers, leading to centralized control of what should be a decentralized autonomous organization. The impact is severe as single users can accumulate overwhelming voting power, manipulate profit distributions, and effectively lock out other potential members from meaningful participation.

Vulnerability Details

Code: https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L140

Impact

1. Single address can own majority voting weight

2. Controls treasury fund usage

3. Dictates membership decisions

4. Manipulates profit sharing

5. Prevents fair entry

Tools Used

Manual Review

Recommendations

Implement strict per-user limits with upgrade consideration