Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unsafe use of transferFrom for DAO currency

gabidev

Summary

Unsafe transferFrom used in the membership factory can break the core logic of the protocol.

Vulnerability Details

On some ERC-20 tokens, the transferFrom() will return false on failure instead of reverting a transaction, a good example of such a token is ZRX: Etherscan code. The transferFrom, which is used throughout the MembershipFactory, is vulnerable to unexpected behaviour. If a currency that does not revert on** transferFrom is used, someone could join a DAO without even paying the fees. **

Impact

Medium.

Tools Used

Manual review.

Recommendations

Use OpenZeppelin's safeERC20 https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol

using SafeERC20 for IERC20;
​
IERC20(daos[daoMembershipAddress].currency).safeTransferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).safeTransferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.