Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Users can upgrade their Tier for free

vladzaev

Summary

There is a possibility for different Tier price when users creates a DAO. He can point different values for each Tier level:

struct TierConfig {
uint256 amount;
@> uint256 price;
uint256 power;
uint256 minted;
}

How ever a user can upgare it at no cost.

Vulnerability Details

Joining the DAO any user should pay a price and fee:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
...
@> uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
...
}

The price may be different for each tier. However, there is no charge for a user to upgrade their tier:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

If there are different price for tiers, a user can purchase the cheapest tier and upgrade to the higher tier at no cost.

Impact

The protocol will lose profit.

Tools Used

Manual review

Recommendations

Consider adding a tier price check and charge a user the difference if he want to upgrade.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!