Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

[low-02] User Can Avoid or Reduce Fees Using upgradeTier

0xarion

Vulnerability Details

In the MembershipFactory contract, the upgradeTier function allows a user to move up in membership tier levels within a DAO of type SPONSORED. However, this function does not require the user to pay the full price difference between the tiers when upgrading. As a result, users can exploit this to access higher tiers without paying the intended tier price.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

Impact

Users can avoid paying full membership prices for higher tiers, leading to financial loss for the DAO if the tier prices are not configured correctly.

Proof of Concept

  1. user joins tier 1 at a price of 100 tokens per membership and purchases two memberships, totaling 200 tokens.

  2. The user then calls upgradeTier to move to tier 2, which normally costs 1,000 tokens.

  3. Through this upgrade, the user accesses tier 2 without paying the full 1,000 token fee

Tools Used

Manual review.

Recommendations

ensure users pay the remaining balance between tiers when upgrading.

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
+ // Calculate price difference between the tiers
+ uint256 priceDifference = higherTierPrice - lowerTierPrice;
+ // Transfer the price difference from the user to the DAO
+ IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, priceDifference);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.