Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inadequate Price Checks Lead to Arbitrary Tier Upgrades

johny7173

Summary

The upgradeTier function allows users to exchange two memberships of a lower tier for one membership of a higher tier without verifying if the higher tier costs at least twice the price of the lower tier. This issue enables users to bypass purchasing higher-tier memberships directly and instead upgrade from two lower-tier memberships if it is more cost-effective.

Vulnerability Details

In the upgradeTier function of the MembershipFactory contract, a user can exchange two memberships of a given tier (e.g., Tier 2) for a single membership in the next higher tier (e.g., Tier 1). However, the functions createNewDAOMembership and updateDAOMembership do not enforce a rule that each higher-tier membership should cost at least double the price of the previous tier.

function createNewDAOMembership(DAOInputConfig calldata daoConfig, TierConfig[] calldata tierConfigs)
external returns (address) {
...
for (uint256 i = 0; i < tierConfigs.length; i++) {
require(tierConfigs[i].minted == 0, "Invalid tier config");
dao.tiers.push(tierConfigs[i]);
}
...
}
​
function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
external onlyRole(EXTERNAL_CALLER) returns (address) {
...
// Reset and update the tiers array
delete dao.tiers;
for (uint256 i = 0; i < tierConfigs.length; i++) {
dao.tiers.push(tierConfigs[i]);
maxMembers += tierConfigs[i].amount;
}
...
}

Impact

This vulnerability makes the upgrade tier functionality obsolete since directly buying a higher tier membership can be cheaper.

Tools Used

Manual Review

Recommended Mitigation

To prevent this exploit, enforce a rule ensuring that each higher-tier membership costs at least double the price of the previous tier. This constraint can be added either during the createNewDAOMembership or updateDAOMembership functions.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.