Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of currency update mechanism in MembershipFactory and MembershipERC1155

peterpepoc

Summary

The MembershipFactory and MembershipERC1155 contracts lack functionality to update the currency address after DAO creation. This inflexibility could lead to locked funds and the issue that dao cannot continue to be used if the original currency token becomes compromised or needs to be upgraded.

Vulnerability Details

In MembershipFactory, the currency is set during DAO creation but has no update mechanism:

function createNewDAOMembership(DAOInputConfig calldata daoConfig, TierConfig[] calldata tierConfigs)
external returns (address) {
// ... other code ...
dao.currency = daoConfig.currency; // Set once, no update mechanism
// ... other code ...
}

Similarly, in MembershipERC1155:

function initialize(
string memory name_,
string memory symbol_,
string memory uri_,
address creator_,
address currency_
) external initializer {
// ... other initialization ...
currency = currency_; // Set once during initialization
// ... other initialization ...
}

The currency address is used in critical functions:

function claimProfit() external returns (uint256 profit) {
// ... other code ...
IERC20(currency).safeTransfer(msg.sender, profit);
// ... other code ...
}
​
function sendProfit(uint256 amount) external {
// ... other code ...
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
// ... other code ...
IERC20(currency).safeTransferFrom(msg.sender, creator, amount);
}

Impact

  1. Unable to switch to new token versions if current token is upgraded

  2. Could lead to locked funds or unable to send profit if token becomes unusable such as token pause

Tools Used

Manual code review

Recommendations

Add currency update functionality and the mechanism for handling old currency

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.