Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No check on the max number of members per tier.

zraxx

Summary

In the function upgradeTier, users can use two tierIndex+1 tokens to exchange for a tierIndex token to obtain the seat. However, according to the logic of the function createNewDAOMembership, the number of members per tier is limited. This means that using the function upgradeTier can break through this limit, thus affecting the contract.

Vulnerability Details

In the function upgradeTier:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1); // @@audit: tier.amount is not checked
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}
​

Users can break through the restrictions by exchanging two low-level tokens for one high-level token.

Impact

The max member of each tier will be bypassed.

Tools Used

VSCode

Recommendations

Add a limit to prevent the number of members from exceeding the maximum members for the tier.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.