Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No user can upgrade their tier in a DAO because of incorrectly implemented `MembershipFactory::upgradeTier` function.

saurabh_singh

Summary

There is a flaw in the MembershipFactory::upgradeTierfunction. It do not upgrade the tier of a user.

Vulnerability Details

When a user calls the MembershipFactory::upgradeTier function, it downgrades the user's tier instead of upgrading it.

the function will mint token of a lower tier because of ( fromTierIndex - 1 ) instead of above tier.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
​
@> IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
@> emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

Impact

the tier of user will downgrade and he gets the token of lower tier.

The tier will be keep of decreasing instead of increasing.

Tools Used

manual review

Recommendations

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
- IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
- emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
​
+ IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex + 1, 1);
+ emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex + 1);
​
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

saurabh_singh Submitter
10 months ago
0xbrivan2 Lead Judge
10 months ago
0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.