Project

Summary

The MembershipFactory contract has a vulnerability that leads to a critical violation of membership constraints in the DAO system. The inconsistent validation logic between creation and updates allows circumvention of initially established membership limits, enabling unauthorized expansion of DAO membership capacity. This undermines the core membership control mechanism of the DAO, potentially affecting tokenomics, voting power distribution, and overall DAO governance structure. The ability to arbitrarily increase membership limits without proper validation poses a serious risk to the DAO's operational integrity and could be exploited to dilute existing member value or manipulate DAO participation parameters.

The issue stems from contradictory logic implementations between the DAO creation and update functions. During creation, the contract enforces strict validation ensuring total tier membership amounts cannot exceed the specified maxMembers limit. However, the update function inverts this relationship by automatically increasing maxMembers when tier amounts exceed it. This logical inconsistency creates a fundamental break in the contract's state invariants.

The following code snippets demonstrate this contradiction:

In createNewDAOMembership:

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L55

While in updateDAOMembership:

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L100

This implementation allows the update function to bypass the fundamental membership constraints established during creation, effectively nullifying the initial validation mechanisms.

Recommended Fix

The fix maintains consistency with the creation function's validation logic and adds necessary checks for minted tokens. It removes the automatic maxMembers increase and enforces the original membership constraints throughout the DAO's lifecycle. Additional validations ensure new tier amounts cannot be set below already minted tokens, preventing potential inconsistencies in the membership state.