Project

Summary

The protocol has implemented an extremely dangerous callExternalContract function in the MembershipFactory that grants the EXTERNAL_CALLER unlimited power over all DAOs. This function can execute any call to any contract without restrictions, effectively centralizing all control to a single role. The admin can drain any treasury, manipulate any membership, or modify any DAO parameter through this function, completely undermining the protocol's security model and decentralization goals.

Vulnerability Details

In MembershipFactory.sol: Code: https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L176

Impact

Financial Risks:

1. Treasury funds can be stolen

2. Member fees can be redirected

3. Token transfers unrestricted

Governance Control:

1. Can override any decision

2. Can remove all members

3. No checks and balances

   Protocol Trust:

   • Complete centralization

   • No member protection

   • Admin dependence

Tools Used

Manual Review

Recommendations

Replace with limited functions