Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Denial of Service, a single user can fill all Dao memberships by calling MembershipFactory::joinDAO multiple times or by using a SmartContract and fill all spaces in a single tx

0xw3

Summary

A single user is able to fill all dao positions because there is no limits of how many times he can join a dao

Vulnerability Details

The vulnerability occours because MembershipFactory::joinDAO method doesnt have a limit of how much times can be called by a single address.
Because of this, a single user (using a contract for eg) can fill all available space in dao by calling MembershipFactory.sol::joinDAO N times, where N is the sum of all dao.tierconfigs.amounts leaving no space for other users to joinDAO.

In the following proof of concept, a single user is able, to fill all positions for a tier in a dao
Add the following code in test/MembershipFactory.test.ts in "Join DAO" section:

it("Single user can fill all dao positions", async function () {
const tierIndex = 0;
await testERC20.mint(addr1.address, ethers.utils.parseEther("200"));
​
​
await testERC20.connect(addr1).approve(membershipFactory.address, TierConfig[tierIndex].price * 100);
for(var i=0; i<10; i++){
await expect(membershipFactory.connect(addr1).joinDAO(membershipERC1155.address, tierIndex)).to.emit(membershipFactory, "UserJoinedDAO");
}
});

Run test, first start a localnode, USE ANVIL cause hardhat node fails:

anvil

Exec test with:

reset; npx hardhat test --network localhost test/MembershipFactory.test.ts

It will take a while, but observe a single user can fill all dao positions

Impact

Denial of Service, making other users unable to join a dao, however attacker must spends funds to do so, so, impact is low

Tools Used

Manual Review

Recommendations

Limit number of times a single user can join a DAO, for eg, to two for tier (to be able to upgradeTier)

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.