Project

Summary

when a user joins a dao, there is a check if the teir is at capacity, if it is not filled up, then it increases the minted by one

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L140-L150

however, when a user upgrades from one teir to another, this minted value is not updated

Vulnerability Details

because the minted value is not updated after upgrades, the teir total capacity is not respected. some teirs will end up with more members than the max and some teirs will not allow users to join even if it is not filled up.

Impact

this will prevent users from joining daos still with capacity. it will also make the profit calculations inaccurate because more users can upgrade to teirs even if it is at capacity

Tools Used

Manual Audit

Recommendations

update the minted value as users upgrade teirs