Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Tier Update Amount Validation Missing in DAO Membership Contract

0xnirix

Summary

The updateDAOMembership function allows setting tier amounts below already minted values, breaking core DAO functionality.

Vulnerability Details

In MembershipFactory.sol, the updateDAOMembership function lacks validation for new tier amounts:

function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
external onlyRole(EXTERNAL_CALLER) returns (address) {
// ...
for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
tierConfigs[i].minted = dao.tiers[i].minted; // Preserves minted count
// No validation that tierConfigs[i].amount >= minted
}
}
delete dao.tiers;
for (uint256 i = 0; i < tierConfigs.length; i++) {
dao.tiers.push(tierConfigs[i]);
}
}

This allows an invalid state where tier.minted > tier.amount, breaking the core invariant check in joinDAO:

require(daos[daoMembershipAddress].tiers[tierIndex].amount >
daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");

Impact

  • Permanently breaks joinDAO() and upgradeTier() functions for affected tiers

  • No new members can join tiers where amount < minted

Tools Used

  • Manual code review

Recommendations

require(tierConfigs[i].amount >= tierConfigs[i].minted, "Cannot reduce amount below minted");

Add validation in updateDAOMembership to maintain tier.amount >= tier.minted invariant.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.