Project

Summary

Incomplete DAO type validation in update function

Vulnerability Details

The createNewDAOMembership amd updateDAOMembership functions maintain the SPONSORED DAO type validation. But type-specific rules for PUBLIC and PRIVATE types are missing

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L55C3-L135C1

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L155C1-L162C1

As it is, there is no difference between PUBLIC and PRIVATE DAO types in createNewDAOMembership and upgradeTier functions.

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/libraries/MembershipDAOStructs.sol#L6C1-L10C2

Impact

Private DAOType rules are not enforced in createNewDAOMembership and upgradeTier functions.

Tools Used

Manual review

Recommendations

Document that PUBLIC and PRIVATE types have no special constraints. Or add specific rules if they're needed for these types.