Submission Details
Severity:
### [H-1] FEE/FUNDS MIS-MANAGEMENT, The `MembershipERC1155.sol::MembershipERC1155` contract isn't correctly receiving funds/TAX after the `MembershipERC1155.sol::joinDAO` function is called, causing the 80% of the funds to be lost
Description: when the MembershipERC1155.sol::joinDAO function is called, the fee paid in the function it caculated and splited into two different parts. in a ratio 80:20, where 20% of the fee goes as protocol fee to the OWPIdentity.sol contract, the other fees(80%) goes to the daoMembershipAddress address parameter, instead of going to the MembershipERC1155.sol contract.
The MembershipERC1155.sol contract calls functions like MembershipERC1155.sol::claimProfit , etc that sends funds from the MembershipERC1155.sol contract to the profit claimer
this is the balance of weth in OWPIdentity 2000000000000000000000
this is the address of the Membership MemberShipERC1155: 0xd2d2be55Eb75d4b2865E68F2817F99341476E9Cd
a_createNewDAO address is: 0x47675F9739d484C0298faEC09Fe04C9D5D60c86E
this is the balance of weth in MembershipERC1155 0
this is the address of the Membership OWPIdentity 0xB7CB3e98D1D4297609B3A5422F802E2Fe6d8b29c
Impact: 80% of the funds is being sent to a wrong proxy address ``daoMembershipAddress`, resulting to a total loss of funds.
Proof of Concept:
function testJoinDAO() public {
vm.startPrank(DefaultAdmin1);
s_CurrencyManager.addCurrency(currency);
console.log("currencyAddress", currency);
bool isItWhitelisted = s_CurrencyManager.isCurrencyWhitelisted(currency);
console.log("isItWhitelisted", isItWhitelisted);
//s_MembershipFactory.createNewDAOMembership();
DAOInputConfig memory s_DAOInputConfig = DAOInputConfig({
ensname: ensName,
daoType: s_DAOType,
currency:currency,
maxMembers: MaxMembers,
noOfTiers: noOfTier
});
TierConfig memory tierConfig1 = TierConfig({
amount: s_amount,
price: s_price,
power: s_power,
minted: s_minted
});
TierConfig memory tierConfig2 = TierConfig({
amount: s_amount,
price: TOKEN_10K,
power: s_power,
minted: s_minted
});
TierConfig[2] memory fixedTierConfig = [tierConfig1, tierConfig2];
// Create a new dynamic array to hold the values
TierConfig[] memory tierConfig = new TierConfig[]();
for (uint256 i = 0; i < fixedTierConfig.length; i++) {
tierConfig[i] = fixedTierConfig[i];
}
address a_createNewDAO = s_MembershipFactory.createNewDAOMembership(s_DAOInputConfig, tierConfig );
vm.stopPrank();
// join A DAO
vm.startPrank(USER1);
wETH.mint(USER1,TOKEN_10K );
wETH.approve(address(s_MembershipFactory), TOKEN_10K);
s_MembershipFactory.joinDAO(a_createNewDAO, 1);
console.log("this is the balance of weth in OWPIdentity ",wETH.balanceOf(address(s_OWPIdentity)));
console.log("this is the address of the Membership MemberShipERC1155:", address(s_MembershipERC1155));
console.log("a_createNewDAO address is:", a_createNewDAO);
console.log("this is the balance of weth in MembershipERC1155 ",wETH.balanceOf(address(s_MembershipERC1155)));
console.log("this is the address of the Membership OWPIdentity", address(s_OWPIdentity));
vm.stopPrank();
}
Recommended Mitigation:
function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
- IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
+ IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), membershipImplementation, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}
RESULT
[PASS] testJoinDAO() (gas: 1438140)
Logs:
currencyAddress 0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
isItWhitelisted true
this is the balance of weth in OWPIdentity 2000000000000000000000
this is the address of the Membership MemberShipERC1155: 0xd2d2be55Eb75d4b2865E68F2817F99341476E9Cd
a_createNewDAO address is: 0x47675F9739d484C0298faEC09Fe04C9D5D60c86E
this is the balance of weth in MembershipERC1155 8000000000000000000000
this is the address of the Membership OWPIdentity 0xB7CB3e98D1D4297609B3A5422F802E2Fe6d8b29c
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.