Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[M-1] daos[daoMembershipAddress].currency in joinDao:: MembershipFactory.sol should be checked if its whitelisted

oluwaseyisekoni

Summary

Since a currency could still be removed as a whitelisted currency even after it was initially added. The protocol should check daos[daoMembershipAddress].currencyin joinDao:: MembershipFactory.solif its whitelisted

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
//@audit there should be be a check on the currecy always as it could have been whitelisted
//even after it was initially added
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

Vulnerability Details

A currency could be removed as whitelisted due to many reasons that could affect the protocol in negative ways such as fraudulent or scam activities, security concerns or breaking some of the protocol's innavriant etc. Checking if the currency is whitelisted could avoid the problems above

Impact

Users can use a non-whitelisted currency

Tools Used

Manual review

Recommendations

check if daos[daoMembershipAddress].currencyis whitelisted

require(currencyManager.isCurrencyWhitelisted(daos[daoMembershipAddress].currency), "Currency not accepted.");
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

0xbrivan2 Lead Judge
11 months ago
0xbrivan2 Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

missing DAO currency update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.