Project

Summary

The upgradeTier function in MembershipFactory.sol allows users to upgrade their membership tiers by burning two tokens of their current tier for one token of the higher tier. However, the lack of a price adjustment or refund mechanism means users often end up paying more than necessary. For example, a user in a lower-priced tier upgrading to a higher-priced tier may pay more by burning tokens than by directly purchasing the higher tier. This results in users being overcharged and provides the protocol with unfair gains.

Vulnerability Details

In the upgradeTier function, users are required to burn two tokens of their current tier to receive one token in the next higher tier. This approach does not account for differences in tier prices, leading to cases where users are charged more than necessary.

For instance, referring to the screenshot provided by the sponsor:

• Tier 6 costs 69.76 USDC, while Tier 5 costs 104.6 USDC.

• If a user in Tier 6 wants to upgrade to Tier 5, burning two Tier 6 tokens means they pay 69.76 * 2 = 139.52 USDC.

• This amount (139.52 USDC) is significantly more than directly purchasing Tier 5 for 104.6 USDC.

As no refund is provided for the excess amount, this results in an unfair charge for users and unintended profits for the protocol.

Relevant Code Snippet

Impact

Overcharge for users and unfair gains for the protocol.

Tools Used

Manual analysis

Recommendations

Implement a price adjustment or refund mechanism when users upgrade their tier. Specifically, calculate the difference between the price of the current tier and the target tier to ensure users pay only the actual upgrade cost.