Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

DAO Creation Does Not Validate ENS Ownership

auditweiler

Summary

The MembershipFactory allows actors to register new DAOs to an ensName. however the claim to that name is not verified.

Vulnerability Details

The MembershipFacory permits callers to specify an arbitrary ensName, provided it has not yet been claimed:

DAOConfig storage dao = daos[address(proxy)];
dao.ensname = daoConfig.ensname; /// @audit Arbitrary calldata
dao.daoType = daoConfig.daoType;
dao.currency = daoConfig.currency;
dao.maxMembers = daoConfig.maxMembers;
dao.noOfTiers = daoConfig.noOfTiers;

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L78C1-L83C45

This permits callers to make claims to ensNames that do not belong to them, and misrepresent the association of the DAO.

Impact

Valuable ENS names can be squat on, meanwhile malicious DAOs can feign association with popular entities (i.e. vitalik.eth).

Tools Used

Manual Review

Recommendations

When creating a DAO, register ownership to a tokenId that is both respected by the ENS Registrar and is owned by (or approved to) the _msgSender().

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.