Project

Summary

The joinDAO function in the contract is vulnerable to a Denial-of-Service (DoS) attack due to reliance on a static owpWallet address for handling platform fees. If the owpWallet address becomes blacklisted by USDC (e.g., due to receiving funds from a malicious address), USDC transfers to owpWallet will fail, causing the entire joinDAO process to revert. This would prevent all users from joining any DAO, effectively blocking the function and causing a DoS.

Vulnerability Details

The joinDAO function currently pushes USDC platform fees directly to owpWallet upon each transaction. Since USDC has blocklisting capabilities, if owpWallet is ever blacklisted (e.g., due to a transfer from a blacklisted address), then any attempts to send USDC to this address will fail, reverting the joinDAO function. The function lacks the flexibility to change the owpWallet address, which risks a permanent DoS on all joinDAO operations if blacklisting occurs.

Code Snippet

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L146

Impact

If owpWallet becomes blacklisted by USDC, all joinDAO operations will fail since the platform fees cannot be transferred, resulting in a DoS for all users attempting to join DAOs. This could disrupt DAO membership and significantly impact the contract's usability, potentially blocking new users from joining.

Tools Used

Manual review

Recommendations

1. Add an onlyOwner Function to Update owpWallet Address:

• Implement an onlyOwner function to allow the contract owner to update the owpWallet address. This provides flexibility to change the address if it ever becomes blacklisted.

** 2 . Switch to a Pull-Based Transfer Model**:

• Consider using a pull-based model, where owpWallet can pull funds from the contract instead of directly transferring funds on each transaction. This reduces reliance on an immediate transfer and can bypass issues related to blacklisting by adjusting permissions.