Project

Summary

Users may inadvertently join the wrong DAO due to a chain reorganization, resulting in the loss of entry fees.

Vulnerability Details

A DAO membership can be created by calling the createNewDAOMembership function:

Observations:

From the above code, it is evident that the DAO membership is implemented as a TransparentUpgradeableProxy deployed by the MembershipFactory contract. Since the deployment uses the new keyword, the address derivation relies solely on the factory’s nonce.

Attack Scenario:

1. Alice Creates a DAO Membership:
   Alice creates a DAO membership, resulting in the deployment of a DAO at address 0xabc.

2. Bob Attempts to Join Alice’s DAO:
   Bob intends to join Alice’s DAO by calling the joinDAO function with daoMembershipAddress set to 0xabc and paying the required entry fee.

3. Reorganization and Exploitation:
   During a blockchain reorganization:

   • Charlie observes Bob’s pending transaction.

   • Charlie quickly creates a new DAO membership using the MembershipFactory identical to Alice’s DAO.

   • Since the DAO address derivation depends solely on the factory's nonce, Charlie’s DAO is deployed at the same address 0xabc.

4. Redirection of Bob’s Payment:
   After the reorg, when Bob’s transaction is confirmed, it interacts with Charlie’s DAO instead of Alice’s. Consequently:

   • Bob's payment and membership are directed to Charlie’s DAO.

Impact

Loss of funds for users: Users will lose the platform fee and the tier price. The impact becomes significantly higher if the user approves the protocol with an allowance of type(uint256).max.

Tools Used

Manual Review

Recommendations

use CREATE2 for deploying the proxy