Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Potential mismatch between `minted` values and the new tier limits in the `updateDAOMembership()` function.

bajagasec

Summary

Potential mismatch between minted values and the new tier limits in the updateDAOMembership() function.

Vulnerability Details

In the updateDAOMembership() function, the following line could lead to issues if the minted value from a previous tier configuration exceeds the new maximum amount defined for that tier:

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L116

for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
--> tierConfigs[i].minted = dao.tiers[i].minted;
}
}
//TrieConfig struct
struct TierConfig {
uint256 amount; //max members in Tier
uint256 price;
uint256 power;
uint256 minted; //minted tokens (joined members)
}

Impact

If minted is greater than the new amount for a tier, it could result in an inconsistency where the number of already minted tokens exceeds the tier’s capacity.

Tools Used

  • Manual Review

  • Visual Studio Code (VSCode)

Recommendations

Add a check to ensure that minted does not exceed amount for each new tier configuration. If minted is greater, it should be capped at the new amount limit, or an error should be thrown to alert the discrepancy.

Variant 1

for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
+ if(tierConfigs[i].amount < dao.tiers[i].minted){
+ tierConfigs[i].amount = dao.tiers[i].minted
+ }
tierConfigs[i].minted = dao.tiers[i].minted;
}
}

Variant 2

for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
+ require(tierConfigs[i].amount >= dao.tiers[i].minted, "amount < minted");
tierConfigs[i].minted = dao.tiers[i].minted;
}
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge
12 months ago
0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.