Summary

The MembershipERC1155 contract is designed to be upgradeable, allowing for future enhancements that may introduce new state variables. However, these new variables may need to be initialized within the initialize() function, potentially causing incompatibility with the existing MembershipFactory contract.

Vulnerability Details

createNewDAOMembership uses hardcoded function signature to initialize the newly deployed MembershipERC1155 contract:
https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L72

Also, the MembershipFactory is not upgradeable and implementation cannot be adjusted to comply with potential changes in the MembershipERC1155.

Impact

Inability to upgrade MembershipERC1155.

Tools Used

Manual review.

Recommendations

Consider making MembershipFactory upgradeable as well.