Summary

The MembershipFactory contract allows users to upgrade their membership tiers. However, during the upgrade process, the minted count for the lower tier is not adjusted, leading to a situation where the total number of tokens minted in that tier does not reflect the actual number of tokens held. This oversight can result in a lack of available slots for new members in the lower tier, potentially causing issues with tier management

Vulnerability Details

In the upgradeTier function, the logic for burning the lower tier token and minting a new token in the higher tier does not update the minted count for the lower tier. The relevant code is as follows:

While the user burns their token from the lower tier and mints a new token in the higher tier, the minted count for the lower tier remains unchanged. This means that the previously minted count does not reflect the actual number of tokens still in circulation, leading to potential issues when new users attempt to join the DAO.

Example of Impact:

1. A DAO has a limit of 10 tokens for Tier 2, and currently, there are 10 tokens minted.

2. A user in Tier 3 decides to upgrade to Tier 2.

3. The user burns their Tier 3 token and mints a new Tier 2 token.

4. The minted count for Tier 2 remains at 10, even though one token has been effectively removed from circulation.

5. As a result, the DAO now has 11 tokens minted in Tier 2, exceeding the limit and preventing new users from joining that tier.

Impact

• Overcrowding of a specific tier, which undermines the purpose of having tier limits.

• Imbalance in voting power and privileges associated with each tier, as the intended exclusivity of higher tiers is compromised.

Tools Used

• Manual code review

Recommendations

1. Adjust Minted Count: