Project

Summary

The sendProfit function in MembershipERC1155.sol can be front run by calls to upgradeTier fucntion in MembershipFactory.sol. This will lead to unfair profit distribution as the malicious actor can inflate his share right before profits are being distributed.

Vulnerability Details

The profit of the participants is being distributed based on their share. The share is calculated by the following function:

By front running the **sendProfit **function with upgradeTier, a malicious actor can inflate his share and therefore steal profit from the other participants.

Impact

The impact of this vulnerability is unfair profit distribution and depending on the scale it is implemented, can steal large amount of profit from DAO participants.

Recommendations

Inroduce delay on the **upgradeTier **fucntion that wil be enough to cover the time a transaction is passing trough.