Github

• https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L155

Summary

The upgradeTier function in the MembershipFactory contract contains a critical vulnerability where users can upgrade to higher tiers without capacity validation and state tracking. This allows bypassing tier capacity limits and creates inconsistencies in membership tracking.

Vulnerability Details

The vulnerability exists in the upgradeTier function which is responsible for handling membership upgrades in sponsored DAOs. This function allows members to upgrade their tier status by burning tokens from their current tier and receiving tokens in a higher tier. However, the implementation lacks crucial security checks and state management:

The function completely lacks capacity validation for the target tier. When a user attempts to upgrade their membership, the function should verify that the higher tier has available capacity before allowing the upgrade. This is a standard check present in the joinDAO function but was omitted here, creating a critical security gap.

Also the state tracking mechanism is fundamentally broken. The function fails to update the minted counter in the DAO's tier configuration after issuing new tokens. This oversight creates a permanent discrepancy between the recorded state and the actual token distribution. The proper implementation would increment the minted counter of the target tier, similar to how joinDAO maintains accurate state:

The implementation demonstrates inconsistent security patterns compared to other membership management functions in the contract. While joinDAO implements robust checks and state updates, these critical security measures are entirely absent in upgradeTier. This inconsistency suggests a possible oversight during the implementation phase rather than a conscious design decision.

Proof of Concept:

Impact

Members can freely upgrade to higher tiers even when they are at capacity, effectively breaking the scarcity model that gives premium tiers their value and exclusivity. The state tracking failure creates an irreparable mismatch between recorded and actual token distribution, making it impossible to enforce membership limits or accurately calculate governance weights. This compromises not only the DAO's operational integrity but also its economic model, as tier-based benefits and voting power become diluted beyond their intended design.

Tools Used

Manual Review

Recommendations

The vulnerability requires both immediate tactical fixes and strategic improvements to the tier management system. Here's the comprehensive solution approach: