Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Ownership Verification in `upgradeTier` Function

brene

Summary

The upgradeTier function does not currently verify whether the caller owns the necessary NFT before allowing an upgrade. This oversight can lead to unauthorized or malicious upgrade attempts, potentially disrupting the DAO's membership structure.

Vulnerability Details

The upgradeTier function assumes that the caller owns the NFT from the specified fromTierIndex without explicitly checking ownership.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

Without verifying ownership, there is a risk that users could attempt to upgrade without actually holding the required NFT, leading to inconsistencies in membership records.

Impact

Unauthorized upgrades could allow users to access higher-tier benefits or governance rights without proper authorization, undermining the DAO's governance structure.

Tools Used

Manual Review

Recommendations

Use the balanceOf function to check that the caller owns at least one NFT from the specified fromTierIndex before proceeding with the upgrade.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
+ require(IMembershipERC1155(daoMembershipAddress).balanceOf(_msg.sender(), fromTierIndex) >= 1, "Insufficient balance.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.