Submission Details
Severity:
Users can avoid paying membership fees
Summary
A simple charging mechanism allows users to avoid paying for the protocol.
Vulnerability Details
When a user wants to join the DAO he should pay the price of Tier. Fees are deducted from this amount:
function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
...
uint256 platformFees = (20 * tierPrice) / 100;
...
}
If the tier price is low, the user will not be charged the protocol fee.
The DAO can also be created with the cheapest tier to buy: to break the calculations and avoid fees.
Impact
Users can avoid paying membership fees
Tools Used
Manual review
Recommendations
Consider adding a BPS system for calculations and decimal protection. The code can be as shown below and used for tokens with different decimals:
uint256 public constant BPS = 10000;
uint256 public constant FEE = 200;
function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
...
uint256 platformFees = (FEE * (tierPrice ** token.decimals)) / BPS;
...
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.