Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing update for tier minted amount and maximum limit check on MembershipFactory::upgradeTier

valy001

Summary

Missing update of DAO minted amount and check for amount limitation on tier config when Dao member try to upgrade their tier level.

Vulnerability Details

DAO member can upgrade their tier level by burning 2 low level tokens to mint 1 high level token. However, the specified DAO's config info is not updated during this procedure. When burning low level nft tokens , the corresponding tier's minterd amount need to minus 2 , while minting high level token, tier's minted need to add 1.

DAO tier amount limitation also need to be check in order to not exceed the maximum allowed number for high level tier.

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L158-L159

Impact

Users may mint more tier members than the DAO limited.

Tools Used

manual

Recommendations

consider update daos[daoMembershipAddress].tiers[tierIndex].minted for both low and high level tier. And add checks for the high level tier amount limitation.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
+ require(daos[daoMembershipAddress].tiers[fromTierIndex-1].amount > daos[daoMembershipAddress].tiers[fromTierIndex-1].minted, "Tier full.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
+ daos[daoMembershipAddress].tiers[fromTierIndex].minted-=2;
+ daos[daoMembershipAddress].tiers[fromTierIndex-1].minted+=1;
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1); //@audit dao tier amount need to check?
}
​
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.