Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Multiple Logic Flaws in DAO Tier Upgrade System

0xnirix

Summary

The upgradeTier() function contains three critical flaws: potential arithmetic underflow, inverted tier availability check, and missing validation for highest tier upgrades.

Vulnerability Details

In MembershipFactory.sol, upgradeTier() has several logical issues:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
// 1. Wrong logic: checks for higher number but upgrades to lower
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
// 2. Can underflow when fromTierIndex = 0
// 3. Missing check for highest tier
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
}

This creates three specific vulnerabilities:

  1. Arithmetic underflow when upgrading from tier 0

  2. Logically inconsistent tier availability check

  3. No guard against upgrading from highest tier

Impact

  • Function reverts when attempting to upgrade from tier 0 due to underflow

  • Incorrect tier availability validation

  • Confusing user experience with inconsistent tier logic

Tools Used

  • Manual code review

Recommendations

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(fromTierIndex > 0, "Already at highest tier");
require(fromTierIndex < daos[daoMembershipAddress].noOfTiers, "Invalid tier");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.