Project

Code Links:
https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L155-L161

Description:

The upgradeTier function in the MembershipFactory contract is designed to allow users to upgrade their membership tier within a sponsored DAO. However, the current implementation contains a critical vulnerability that does not check whether the target tier is filled to its maximum capacity. This oversight can lead to an increase in the number of members in a tier beyond its defined limit, which undermines the integrity of the membership structure.

Vulnerability Details

The function does not include a check to verify if the target tier (the tier the user is upgrading to) has reached its maximum capacity. Each tier is defined to have a maximum number of members, but this constraint is not enforced during the upgrade process.

When a user upgrades their tier, the function burns their current tier membership and mints a new membership for the target tier. If the target tier is already at its maximum capacity, this operation will result in an additional member being added to that tier, violating the defined membership limits.

Impact:

• Allowing more members than the defined maximum in a tier can lead to several issues:

  • Dilution of Membership: The value and benefits associated with each tier may diminish as more members are added beyond the intended limits.

  • Inequity Among Members: Existing members in the target tier may feel disadvantaged if the tier becomes overcrowded, leading to dissatisfaction and potential governance issues within the DAO.

  • Operational Confusion: The DAO's operational logic may become inconsistent, as the actual number of members in a tier does not align with the expected limits defined in the tier configuration.

Proof of Concept:

Recommended Mitigation:

1. Updated Function Implementation: