Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unrestricted DAO Token Transfers Enable Membership and Profit Manipulation

0xnirix

Summary

MembershipERC1155 lacks transfer restrictions, allowing unrestricted token transfers. This enables unauthorized DAO access, profit manipulation through token splitting, and bypassing of membership controls.

Vulnerability Details

Issue: Missing transfer restrictions in MembershipERC1155 _update() function

Vulnerable Components:

// 1. No Transfer Restrictions
function _update(
address from,
address to,
uint256[] memory ids,
uint256[] memory amounts
) internal virtual override(ERC1155Upgradeable) {
// Only profit tracking, no transfer checks
if (from != address(0)) saveProfit(from);
if (to != address(0)) saveProfit(to);
super._update(from, to, ids, amounts);
}
​
// 2. Exploitable Profit Calculation
function shareOf(address account) public view returns (uint256) {
return (balanceOf(account, 0) * 64) + // Can split across addresses
(balanceOf(account, 1) * 32) + // for increased profits
...
}

Attack Vectors:

  • Secondary market trading bypasses DAO controls

  • Token splitting for profit manipulation

  • Banned users can simply rebuy tokens

Impact

  • Unrestricted membership transfers

  • Manipulatable profit distribution

  • Broken access controls

  • Bypassed member verification

Tools Used

  • Manual code review

Recommendations

  1. Add Transfer Restrictions:

function _update(
address from,
address to,
uint256[] memory ids,
uint256[] memory amounts
) internal virtual override(ERC1155Upgradeable) {
require(from == address(0) || to == address(0), "Non-transferable");
super._update(from, to, ids, amounts);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.