Project

Summary

MembershipFactory will fail to deploy future implementations of MembershipERC1155

Vulnerability Details

Users can call MemebershipFactory.createNewDAOMembership() to create a new DAO contract, which consists of a TransparentUpgradeableProxy contract that uses 'membershipImplementation' as implementation contract. The issue is that the function calls initialize() in the deployed contract with a fixed function selector and parameters.

Which is valid for this initial implementation of MembershipERC1155:

However, if future versions of this implementation contract require different initialization parameters, probably because they include new features or state variables (e.g. a DAO operator role, a fee receiver address or a fee amount to pay) contract deployment will revert, as the initialize() function's signature being called does not exist inside the new implementation contract.

This happens because when upgradeAndCall() is executed inside Proxy contract, the verification of the called function will return false, making the deployment revert.

Impact

Future implementations of MemebershipERC1155 are prevented from having new state variables, limiting the functionalities of deployed DAOs, which cannot be deployed with MemebershipFactory.createNewDAOMembership().

Tools Used

Manual review, Remix

Recommendations

Let the calldata used for initializing the TransparentUpgradeableProxy be variable. As some parameter should always be fixed, ADMIN may set those fixed parameters and let DAO creator use arbitrary ones: