Project

Summary

The upgradeTier function in MembershipFactory.sol emits a UserJoinedDAO event that indicates a user joined the DAO, rather than upgraded their tier. This event can create confusion in off-chain systems tracking DAO activities, as they may misinterpret an upgrade as a new join.

Vulnerability Details

In the upgradeTier function, the emitted event is UserJoinedDAO, which typically signals that a user has joined a DAO for the first time. However, in the context of this function, the user is upgrading their existing membership tier. Off-chain systems relying on this event for tracking membership actions could incorrectly log a tier upgrade as a new DAO entry, which can lead to incorrect record-keeping and user tracking.

Here is the relevant section of the code:

This use of the UserJoinedDAO event does not accurately represent the action taking place.

Impact

The current implementation can cause off-chain systems to display incorrect information, potentially leading users or administrators to believe a user has joined the DAO multiple times rather than upgraded their membership tier.

Tools Used

VSCode

Recommendations

Define a new event, such as UserUpgradedTier, to clearly indicate when a user upgrades their membership tier. Emit this new event instead of UserJoinedDAO within the upgradeTier function to accurately communicate the action taking place.