Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Non-Functional Tier Upgrade System in MembershipFactory

0xnirix

Summary

The upgradeTier function always fails as it attempts to burn 2 tokens when users only have 1 token per tier.

Vulnerability Details

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2); // Will always fail
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
}

Users receive only 1 token in joinDAO and tokens are non-transferrable, making it impossible to burn 2.

Impact

  • SPONSORED DAOs tier upgrade system is completely non-functional

  • No workaround exists in current implementation

Tools Used

Manual code review

Recommendations

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 1);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.