Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Tier Removal Creates Inconsistent Token State in DAO Membership

0xnirix

Summary

updateDAOMembership allows removal of tier levels while existing tokens of those tiers remain active, creating inconsistent state and broken functionality.

Vulnerability Details

In MembershipFactory.sol, updateDAOMembership can reduce number of tiers:

delete dao.tiers;
for (uint256 i = 0; i < tierConfigs.length; i++) {
dao.tiers.push(tierConfigs[i]);
}

This creates orphaned tokens when:

  • Existing tokens belong to removed tiers

  • Their minted values are lost but tokens remain active

  • shareOf() still counts weights for removed tiers

  • Users can't upgrade from removed tier levels

Impact

  • Broken profit distribution due to counting non-existent tier weights

  • Users stuck with tokens of removed tiers

  • Inconsistent state between tiers and existing tokens

Tools Used

  • Manual code review

Recommendations

require(tierConfigs.length >= dao.tiers.length ||
!hasExistingTokens(dao.tiers.length, tierConfigs.length),
"Cannot remove tiers with existing tokens");

Add validation to prevent tier removal when tokens exist for those tiers.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge
7 months ago
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.