Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`updateDAOMembership`, `updateMembershipImplementation` and `setCurrencyManager` of `MembershipFactory` do not emit an event which it should do

sakibcy

Summary

updateMembershipImplementation and setCurrencyManagerof MembershipFactory is an important state change on the DAO.

Those should emit an event.

Vulnerability Details

updateDAOMembership, updateMembershipImplementation and setCurrencyManager should emit an event of MembershipFactory.

Here is the updateDAOMembershipfunction of MembershipFactory

2024-11-one-world/contracts/dao/MembershipFactory.sol at main · Cyfrin/2024-11-one-world

function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs) // @audit no emit event
external onlyRole(EXTERNAL_CALLER) returns (address) {
address daoAddress = getENSAddress[ensName];
require(tierConfigs.length <= TIER_MAX, "Invalid tier count.");
require(tierConfigs.length > 0, "Invalid tier count.");
require(daoAddress != address(0), "DAO does not exist.");
DAOConfig storage dao = daos[daoAddress];
if(dao.daoType == DAOType.SPONSORED){
require(tierConfigs.length == TIER_MAX, "Invalid tier count.");
}
​
uint256 maxMembers = 0;
​
// Preserve minted values and adjust the length of dao.tiers
for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
tierConfigs[i].minted = dao.tiers[i].minted;
}
}
​
// Reset and update the tiers array
delete dao.tiers;
for (uint256 i = 0; i < tierConfigs.length; i++) {
dao.tiers.push(tierConfigs[i]);
maxMembers += tierConfigs[i].amount;
}
​
// updating the ceiling limit acc to new data
if(maxMembers > dao.maxMembers){
dao.maxMembers = maxMembers;
}
​
dao.noOfTiers = tierConfigs.length;
return daoAddress;
}

2024-11-one-world/contracts/dao/MembershipFactory.sol at main · Cyfrin/2024-11-one-world

/// @notice Updates the implementation contract for future proxies
/// @param newImplementation The address of the new implementation contract
function updateMembershipImplementation(address newImplementation) external onlyRole(DEFAULT_ADMIN_ROLE) {
require(newImplementation != address(0), "Invalid address");
membershipImplementation = newImplementation;
}

2024-11-one-world/contracts/dao/MembershipFactory.sol at main · Cyfrin/2024-11-one-world

function setCurrencyManager(address newCurrencyManager) external onlyRole(DEFAULT_ADMIN_ROLE) {
require(newCurrencyManager != address(0), "Invalid address");
currencyManager = ICurrencyManager(newCurrencyManager);
}

Impact

It is recommended that an event be emitted on import state change.

Otherwise, without event logs, it becomes more difficult to track the state changes of the contract, especially in complex scenarios.

Tools Used

Manually Reviewed.

Recommendations

Emit an event after updating updateDAOMembership, membershipImplementation, setCurrencyManager.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.