Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Creator cannot update their own DAO

irondevx

Summary

MembershipFactory::updateDAOMembership is restricted to only EXTERNAL_CALLER role, preventing DAO creators from updating their own DAOs' tier configurations, which contradicts the protocol's intended functionality.

Vulnerability Details

The issue stems from overly restrictive access control in the updateDAOMembership function. The function uses onlyRole(EXTERNAL_CALLER) modifier, which means:

  • Only addresses with EXTERNAL_CALLER role can update DAOs

  • Original DAO creators lose control over their DAOs after creation

  • No ownership or creator-specific permissions are implemented

  • Centralization of DAO management to role holders

Impact

  • DAO creators cannot modify their DAO configurations after creation

  • Tier management becomes centralized to EXTERNAL_CALLER role holders

  • Forces creators to rely on admin intervention for basic DAO operations

  • Could lead to abandoned/stuck DAOs if admins are unresponsive

Tools Used

Manual Review

Proof of Concept

MembershipFactory.sol#L101

function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
@> external onlyRole(EXTERNAL_CALLER) returns (address) {
...
}

Recommended Mitigation Steps

Add ownership check to allow DAO creators to update their own DAOs:

function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
external
- onlyRole(EXTERNAL_CALLER)
returns (address)
{
address daoAddress = getENSAddress[ensName];
require(daoAddress != address(0), "DAO does not exist.");
+ require(
+ hasRole(EXTERNAL_CALLER, _msgSender()) ||
+ userCreatedDAOs[_msgSender()][ensName] == daoAddress, // allow creator to update their own DAO
+ "Not authorized"
+ );
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.