Project

Summary

There is a significant security risk in the MembershipFactory contract where an account with EXTERNAL_CALLER role can bypass critical membership constraints and arbitrarily modify any DAO's configuration. Since the constructor grants both DEFAULT_ADMIN_ROLE and EXTERNAL_CALLER to msg.sender, and there's no additional authorization check in updateDAOMembership, this effectively means anyone with EXTERNAL_CALLER role can modify any DAO's configuration regardless of ownership. This can lead to unauthorized manipulation of DAO structures, potential theft of value through tier modifications, and compromise of DAO governance mechanisms.

The issue lies in insufficient access control in the updateDAOMembership function. While the function checks for EXTERNAL_CALLER role, it fails to validate whether the caller has legitimate authority over the specific DAO being modified. The constructor shows that EXTERNAL_CALLER role is granted at deployment, but the update function doesn't implement any additional checks to verify if the caller is the actual DAO owner or has legitimate authority to modify a specific DAO's configuration.

Current vulnerable implementation:

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L100

Compared to DAO creation which establishes ownership:

Recommended Fix

The fix adds crucial ownership validation by checking userCreatedDAOs mapping to ensure only the original DAO creator can modify its configuration, while maintaining the role-based access control and existing validation logic.