Summary

The protocol is vulnerable to a Denial of Service attack targeting DAOs attempting to register unique names.
because of the very low transaction fees on Polygon, an attacker can continually preventing new DAOs registrations
by creating simple bot monitoring mempool and copying the DAO's name.

Vulnerability Details

An attacker can exploit this issue by monitoring the mempool for DAO registration transactions.
Upon identifying a new registration attempt, the attacker's bot can instantly copy the intended name and preemptively register it before the legitimate DAO's transaction is confirmed. This registration race condition is feasible on Polygon due to its low fees, which allows the attacker to perform repeated actions at minimal cost. This tactic effectively DoSes the new DAOs by preventing it from registering.

NOTE: the attacker can dos specific DAO by looking into specific sender in mempool or he can just dos DAOs harm the protocol.

POC:

Impact

Any one can prevent any new DAO from registration and this will be very bad for the protocol reputation and making it useless, if they are unable to register.

Recommendations

Since the name is sent in Tx and it is required to be unique to pass this line of code require(getENSAddress[daoConfig.ensname] == address(0), "DAO already exist."); i suggest to move to L2s that has private mempool so no one can see the mempool and copy the new DAOs names.