Project

Summary

For the PUBLIC and PRIVATE DAOs, if the input tierConfigs.length of updateDAOMembership() was less than DAOConfig.tiers.length of that DAO the reduced slots will be lost.

##Lines Of Code

[Link](https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L100)

[Link](https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L113C1-L118C10)

[Link](https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L120C1-L121C26)

Vulnerability Details

See the updateDAOMembership() loop that Preserve minted values and adjust the length of dao.tiers.

Apparently, it doesn't check if the tierConfigs.length input is less than the DAOConfig.tiers.length,
If so, the function will loop through the tierConfigs.minted setting it equal to DAOConfig.tiers.minted from slot 0 to the (tierConfigs.length - 1) slot.
then Resetting the tiers array losing track of any additional tiers in the following line:

POC

here is a real scenario that explains how it could happen:

1. Bob have a Public DAO contains 7 tiers.

2. Alice and Jess and their friends bought the 7th tier as a start.

3. Bob decides to Update the tier configurations and take off the 7th tier.

4. Bob calls updateDAOMembership("someName", TierConfig[5]).

5. The function reaches the loop and stores the DAOConfig.tiers.minted inside tierConfigs.minted from slot 0 to the slot 5 (from 1 to 6) then it breaks.

6. Then it deletes DAOConfig.tiers.minted in order to reset and update the tiers array.

7. Alice and Jess and their friends will get angry.

##Impact

Loss of user's NFTs
Considering the medium likelihood and the impact on the core contract I will submit it as a high severity.

Tools Used

Deep Analysis

Recommendations

I am not sure what is the solution here because it would be a choice based on the sponsor opinion.

1. I would recommend handling the reduced Tier by burning them and transfer the price back to the user.

2. Or prevent the DAO creator from reducing number of Tiers.