Project

Summary

The MembershipFactory contract includes an extremely powerful callExternalContract function that allows the EXTERNAL_CALLER role to execute arbitrary calls to any contract with any parameters. This design creates a critical vulnerability where the admin can manipulate any aspect of any DAO in the protocol, including draining funds, burning memberships, or modifying core functionality. The function essentially acts as a "master key" to the entire protocol, contradicting fundamental principles of decentralization and security.

Vulnerability Details

Code: https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L176

Impact

1. Treasury Security:

   • Admin can withdraw any tokens

   • Can redirect member payments

   • No fund safety

2. Membership Control:

   • Can burn any tokens

   • Can modify balances

   • No member protection

3. DAO Integrity:

   • Complete admin control

   • No decentralization

   • No member governance

Tools Used

Manual Review

Recommendations

1. Remove unrestricted call capability

2. Implement specific admin functions

3. Add timelock for critical operations

4. Require member voting

5. Use multisig control