Project

Summary

The MembershipFactory contract maps DAOs to ENS names, which can potentially expire or be transferred to new owners. In the case of expiration, the new owner of the ENS name is unable to create a DAO because the mapping still points to the previous owner's DAO configuration. This limitation can hinder the functionality of the contract and restrict legitimate users from utilizing the DAO creation features.

Vulnerability Details

The createNewDAOMembership function checks if a DAO already exists by verifying the mapping of ENS names to DAO addresses:

If the ENS name has expired or been transferred, the new owner will not be able to create a new DAO with that ENS name, as the mapping will still reference the previous DAO configuration. This creates a situation where the new owner is effectively locked out of creating a DAO, even though they have rightful ownership of the ENS name.

Example of Impact:

1. A DAO is created and mapped to an ENS name (e.g., example.dao).

2. the ENS name expires and a new owner bought it .

3. The new owner attempts to create a new DAO using the same ENS name.

4. The createNewDAOMembership function fails with the error "DAO already exist," preventing the new owner from creating a DAO.

Impact

The impact of this vulnerability is significant, as it can lead to:

• new owners of ENS names are unable to create DAOs.

• A decrease in the overall usability and flexibility of the MembershipFactory contract.

Tools Used

• Manual code review

Recommendations

The issue arises from mapping the DAOs to ENS names without considering the change of ownership of ENS names ( which is frequent for popular ENS names ) . Some mitigations could be :

1. Implement ENS Ownership Verification: Before allowing the creation of a DAO, verify that the caller is the current owner of the ENS name. This can be done using an ENS resolver to check ownership.

2. Allow DAO Re-creation: Introduce a mechanism to allow the new owner of an expired or transferred ENS name to create a new DAO, potentially by clearing the existing mapping if the ENS name is no longer valid.