Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing validation for the fromTierIndex condition.

kevinkkien

Summary

The upgradeTier function allows users to upgrade their tier in a DAO of type SPONSORED. However, the function does not check whether the fromTierIndex value is valid before performing operations. If fromTierIndex is 0, the function will fail because subtracting 1 from fromTierIndex will result in an invalid tier index (a negative tier). This can cause unintended errors and disrupt the tier upgrade process.

Vulnerability Details

In the upgradeTier function, the user can select their current tier (fromTierIndex) to upgrade. However, the function does not perform a validity check for the fromTierIndex value, so if the user enters a value of 0 (the first tier), the function will subtract 1, resulting in fromTierIndex - 1 = -1, which is invalid and can cause errors when accessing tier data.

Specifically, when the user provides fromTierIndex as 0:

  • fromTierIndex - 1 becomes -1, causing an attempt to access the tier with index -1, which will lead to an error or undefined behavior.

  • Additionally, when calling the burn or mint methods on the ERC1155 contract, index -1 will be invalid and may cause transaction errors or contract reverts.

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L159

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

Impact

If the user provides fromTierIndex = 0, the calculation of the next tier index will result in an error, causing the transaction to be reverted or unable to be executed.

Tools Used

manual

Recommendations

Check that the value of fromTierIndex is greater than 0 and less than the total number of available tiers in the DAO.

require(fromTierIndex > 0, "Invalid tier index: Cannot be 0.");
require(fromTierIndex < daos[daoMembershipAddress].noOfTiers, "Invalid tier index: No higher tier available.");
​
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.