Project

Summary

The MembershipFactory::joinDAO function lacks validation for whitelisted currencies, allowing users to join DAOs with currencies that have been removed from the whitelist. This creates a critical vulnerability where users can interact with deprecated or potentially malicious currencies.

Vulnerability Details

The current implementation:

Attack Scenario:
// 1. Currency Z is whitelisted
currencyManager.addCurrency(currencyZ);

// 2. DAO created with Currency Z
createNewDAOMembership(..., currencyZ, ...);

// 3. Currency Z later removed
currencyManager.removeCurrency(currencyZ);

// 4. Users can still join using removed Currency Z
// No validation prevents this!
joinDAO(daoAddress, tierIndex); // Still works with removed currency

Impact

1. Financial Risks:

• Users can join using deprecated currencies

• Potential loss of funds through removed/compromised tokens

• Platform fees collected in invalid currencies

2. Trust issues for Protocol

Tools Used

Manual review

Recommendations

Implement check for currency validation