Submission Details
Severity:
Low-level calls do not check for contract existence
Summary
callExternalContract() uses low level call which return true as their first return value if the account called is non-existent based on solidity docs.
Vulnerability Details
https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L176C1-L180C6
https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/tokens/MembershipERC1155.sol#L218C1-L222C6
Impact
Invalid call would succeed, potentially losing funds.
Tools Used
Manual review.
Recommendations
Implement contract existance check inside callExternalContract().
function doesContractExist(address contractAddress) external view returns (bool) {
// Check if the contract's code size is greater than zero
uint256 codeSize;
assembly {
codeSize := extcodesize(contractAddress)
}
return codeSize > 0;
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.