Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Immutable Creator Address Breaks Profit Distribution After Role Transfer

0xnirix

Summary

The MembershipERC1155 contract uses an immutable creator address for profit redirection when totalSupply=0, which becomes inconsistent if the DAO_CREATOR role is transferred to a new address.

Vulnerability Details

In MembershipERC1155.sol, the creator address and profit distribution logic have a critical disconnect:

// Creator set once, never updated
function initialize(..., address creator_, ...) external initializer {
creator = creator_;
_grantRole(DAO_CREATOR, creator_);
}
​
// Uses immutable creator for profit distribution
function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
} else {
// Profits always go to original creator, even after role transfer
IERC20(currency).safeTransferFrom(msg.sender, creator, amount);
}
}

When the DAO_CREATOR role is transferred using AccessControl's role management, the creator variable remains unchanged, causing profits to be sent to the original creator rather than the current role holder.

Impact

  • Original creator continues receiving profits after transferring DAO_CREATOR role

  • Only affects profit distribution when totalSupply=0

  • Breaks intended profit distribution after role transfer

Tools Used

  • Manual code review

Recommendations

Either:

// Option 1: Update creator with role
function _grantRole(bytes32 role, address account) internal override {
super._grantRole(role, account);
if (role == DAO_CREATOR) {
creator = account;
}
}
​
// Option 2: Use role check instead of creator address
function sendProfit(uint256 amount) external {
if (totalSupply > 0) {
// existing logic
} else {
address currentCreator = _getRoleMember(DAO_CREATOR, 0);
IERC20(currency).safeTransferFrom(msg.sender, currentCreator, amount);
}
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.