Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Private DAO Access Control Missing in joinDAO Function

0xnirix

Summary

The joinDAO() function lacks access control checks for PRIVATE DAOs, allowing unauthorized users to join private DAOs directly.

Vulnerability Details

In MembershipFactory.sol, joinDAO() has no validation for DAO type:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount >
daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
// Directly allows joining with only tier validation
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
// ... payment and minting logic
}

The function ignores the DAOType.PRIVATE flag which is intended to restrict membership access, making the PRIVATE type effectively meaningless.

Impact

  • Allows unauthorized users to join private DAOs by simply calling joinDAO()

  • Completely bypasses intended access control for private communities

Tools Used

  • Manual code review

Recommendations

require(
daos[daoMembershipAddress].daoType != DAOType.PRIVATE ||
hasJoinPermission(daoMembershipAddress, msg.sender),
"Not authorized for private DAO"
);

Add DAO type validation in joinDAO() to enforce private access control.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.