Project

Summary

The createNewDAOMembership function in MembershipFactory is vulnerable to reorganization (reorg) attacks due to its use of deterministic proxy addresses. When a user attempts to create a DAO, an attacker can observe the transaction, calculate the expected proxy address, and front-run with their own DAO creation. During a chain reorganization, this could result in the attacker gaining control of a DAO address that receives the original creator's intended funds.

Vulnerability Details

Code: https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts%2Fdao%2FMembershipFactory.sol#L72

Impact

1. Fund Loss:

   • Initial treasury funds can be stolen

   • Membership fees go to attacker's DAO

   • User loses intended DAO control

2. DAO Control:

   • Attacker gains admin rights

   • Can manipulate membership

   • Controls treasury decisions

Tools Used

Manual Review

Recommendations

1. Add creation commit-reveal.