Submission Details
Severity:
`TierConfig.minted` is not updated after calling `membershipFactory::upgradeTier` function, causing the tiers to have wrong value for minted.
Description: After the MembershipFactory::upgradeTier was called, tokens from the current tier was burned and a new token for the upgraded tier was minted. However, the TierConfig.minted was not decremented and incremented for the current and upgrade tiers respectively. This makes the the TierConfig struct to have wrong value of minted tokens for the corresponding tiers.
Number of minted before upgrade in tier index: 2
Number of minted after upgrade in tier index: 2
Number of minted after upgrade in tier index - 1: 0
**Impact:**If the TierConfig.minted is not updated, it means the users will still have their tokens from the previous tiers, after calling the membershipFactory::upgradeTier function.
Proof of Concept:
function testUpgrageTier() public {
vm.startPrank(DefaultAdmin1);
s_CurrencyManager.addCurrency(currency);
bool isItWhitelisted = s_CurrencyManager.isCurrencyWhitelisted(currency);
//s_MembershipFactory.createNewDAOMembership();
DAOInputConfig memory s_DAOInputConfig = DAOInputConfig({
ensname: ensName,
daoType: s_DAOType,
currency:currency,
maxMembers: MaxMembers,
noOfTiers: TIER_MAX
});
TierConfig memory tierConfig1 = TierConfig({
amount: s_amount,
price: s_price,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig2 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig3 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig4 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig5 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig6 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig7 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig[7] memory fixedTierConfig = [tierConfig1, tierConfig2, tierConfig3, tierConfig4, tierConfig5, tierConfig6, tierConfig7];
// Create a new dynamic array to hold the values
TierConfig[] memory tierConfig = new TierConfig[]();
for (uint256 i = 0; i < fixedTierConfig.length; i++) {
tierConfig[i] = fixedTierConfig[i];
}
address a_createNewDAO = s_MembershipFactory.createNewDAOMembership(s_DAOInputConfig, tierConfig );
vm.stopPrank();
// USER1 JOINS A DAO
vm.startPrank(USER1);
wETH.mint(USER1,TOKEN_10K );
wETH.approve(address(s_MembershipFactory), TOKEN_10K);
s_MembershipFactory.joinDAO(a_createNewDAO, 1);
console.log("this is the balance of weth in 1155 contract ",wETH.balanceOf(address(s_OWPIdentity)));
console.log(address(s_OWPIdentity));
vm.stopPrank();
// USER2 JOINS A DAO
vm.startPrank(USER1);
wETH.mint(USER1,TOKEN_10K );
wETH.approve(address(s_MembershipFactory), TOKEN_10K);
s_MembershipFactory.joinDAO(a_createNewDAO, 1);
DAOConfig memory daoConfig = s_MembershipFactory.getDAOConfig(a_createNewDAO);
console.log("before minted count in tier 2:", daoConfig.tiers[1].minted);
vm.stopPrank();
vm.startPrank(USER1);
s_MembershipFactory.upgradeTier(a_createNewDAO, 1);
DAOConfig memory daoConfig2 = s_MembershipFactory.getDAOConfig(a_createNewDAO);
console.log("After minted count in tier 2:", daoConfig2.tiers[1].minted);
console.log("After minted count in tier index 0:", daoConfig2.tiers[0].minted);
vm.stopPrank();
}
Recommended Mitigation:
function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
+ daos[daoMembershipAddress].tiers[fromTierIndex].minted -= 2;
+ daos[daoMembershipAddress].tiers[fromTierIndex - 1].minted += 1;
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}
Number of minted before upgrade in tier index: 2
Number of minted after upgrade in tier index: 0
Number of minted after upgrade in tier index - 1: 1
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.