Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No incentive for users to upgrade membership to higher tier

dimah7

Vulnerability Details

Users can upgrade their membership tier in order to get greater weight when their share of total profits is calculated. This is how the weights look:

function shareOf(address account) public view returns (uint256) {
return (balanceOf(account, 0) * 64) +
(balanceOf(account, 1) * 32) +
(balanceOf(account, 2) * 16) +
(balanceOf(account, 3) * 8) +
(balanceOf(account, 4) * 4) +
(balanceOf(account, 5) * 2) +
balanceOf(account, 6);
}

This function is used when users unsaved profits are calculated when they want to claim:

function getUnsaved(address account) internal view returns (uint256 profit) {
return ((totalProfit - lastProfit[account]) * shareOf(account)) / ACCURACY;
}

So the protocol offers dao members to be able to upgrade their tier, by burning 2 of higher index and minting 1 of lower one, which will have greater weight:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
...
@> IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
@> IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
...
}

However upgrading to a higher tier will not accrue users more rewards to claim. Consider the following scenario:

  1. A user burns 2 amounts of index 1 -> weight (32 + 32)

  2. He will have minted 1 amount of index 0 -> weight (64)

So basically he gets the same weight.

Tools Used

Manual Review

Recommendations

I would recommend to change the weight of the lowest index (i.e 0) to a greater number. This way users will be incentivized to update to tiers with greater weight until they reach the highest one.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

dimah7 Submitter
12 months ago
0xbrivan2 Lead Judge
11 months ago
0xbrivan2 Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.