Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

totalmembers has to be less than maxMembers doesn't seem to be right

kwakudr

Summary

totalmembers has to be less than maxMembers doesn't seem to be right

Vulnerability Details

// enforce maxMembers
uint256 totalMembers = 0;
for (uint256 i = 0; i < tierConfigs.length; i++) {
totalMembers += tierConfigs[i].amount;
}
require(totalMembers <= daoConfig.maxMembers, "Sum of tier amounts exceeds maxMembers.");
function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

totalmembers has to be less than maxMembers doesn't seem to be right. maxMembers is the maximum members for the dao membership. totalMembers Calculates total possible members across all tiers and it validates against maximum allowed members (daoConfig.maxMembers).

totalMembers sums up tier amounts and compares against daoConfig.maxMembers. It ensures sum doesn't exceed maxMembers. The issue is that this is not enforced in joinDAO.

totalMembers will always exceed daoConfig.maxMembers in joinDAO

Impact

the invariant totalMembers must be less than daoConfig.maxMembers will be broken in joinDAO function

Tools Used

Manual Review

Recommendations

//enforce maxMembers in joinDAO function as well

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.