Summary

The upgradeTier function lacks tier capacity validation, allowing users to upgrade to full tiers.

Vulnerability Details

• Location: MembershipFactory.sol, upgradeTier() function

• The function performs tier upgrades without checking if the target tier has available capacity

• While joinDAO() enforces tier limits with require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted), upgradeTier() lacks this check

• Missing tier capacity tracking: minted counts aren't updated during upgrades

• Current check only validates existence of higher tier: require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1)

Impact

HIGH - Tier capacity limits can be exceeded, breaking DAO membership structure and governance mechanisms.

Tools Used

Manual code review

Recommendations