Project

One World

NFTDeFi

15,000 USDC

View results

Previous Next

Submission Details

Severity: medium

Invalid

M1: The "MembershipFactory.upgradeTier" Function Does Not Update the "daos[daoMembershipAddress].tiers[tierIndex].minted" Variable

azanux

Summary

The "MembershipFactory.upgradeTier" function does not update the "daos[daoMembershipAddress].tiers[tierIndex].minted" variable. This oversight could allow the total number of minted tokens to exceed the maximum limit set by the protocol, leading to an inconsistency within the protocol.

Vulnerability Details

When a user joins a DAO at, for example, Tier level 5, a token is minted, and the minted token count is incremented to ensure that the maximum number of tokens for that tier (e.g., 10) is not exceeded.

However, a user could mint 10 tokens at Tier level 5, then mint 10 more tokens at Tier level 6, and subsequently upgrade the Tier 6 tokens back to Tier 5. As a result, the user could end up with 15 tokens at Tier 5, even though the protocol only permits a maximum of 10 tokens to be minted at this level.

This creates an inconsistency within the protocol.

Impact

This vulnerability allows a user to acquire more rights than intended by the protocol.

Tools Used

Foundry and manual review

Copy this code

// SPDX-License-Identifier: UNLICENSED

pragma solidity ^0.8.0;

import {Test, console} from "forge-std/Test.sol";

import {MembershipFactory} from "../contracts/dao/MembershipFactory.sol";

import {MembershipERC1155} from "../contracts/dao/tokens/MembershipERC1155.sol";

import {CurrencyManager} from "../contracts/dao/CurrencyManager.sol";

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import {OWPERC20} from "../contracts/shared/testERC20.sol";

import {DAOConfig, DAOInputConfig, TierConfig, DAOType} from "../contracts/dao/libraries/MembershipDAOStructs.sol";

import {ProxyAdmin} from "@openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol";

import {TransparentUpgradeableProxy} from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";

contract Finding_01Test is Test {

MembershipFactory membershipFactory;

MembershipERC1155 membershipERC1155;

CurrencyManager currencyManager;

ProxyAdmin proxyAdmin;

IERC20 USDC = IERC20(0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359);

IERC20 WBTC = IERC20(0x1BFD67037B42Cf73acF2047067bd4F2C47D9BfD6);

IERC20 WETH = IERC20(0x7ceB23fD6bC0adD59E62ac25578270cFf1b9f619);

OWPERC20 testERC20;

address owner = address(this);

address alice = address(0x1);

address bob = address(0x2);

address attacker = address(0x3);

address[] addrs;

uint64 constant TIER_MAX = 7;

address private currency1;

address private currency2;

function setUp() public {

uint256 polygonChainid =

vm.createFork("https://polygon-mainnet.g.alchemy.com/v2/XXXXXXXXXXXXXXXX");

vm.selectFork(polygonChainid);

console.log("active fork: ", polygonChainid);

// Deploy Currency Manager

currencyManager = new CurrencyManager();

// Deploy Membership ERC1155 implementation

membershipERC1155 = new MembershipERC1155();

// Deploy Membership Factory

membershipFactory = new MembershipFactory(

address(currencyManager), address(owner), "https://baseuri.com/", address(membershipERC1155)

);

// Deploy Test ERC20

testERC20 = new OWPERC20("OWPERC20", "OWP");

//array of TierConfig

// Initialize Tier configurations

TierConfig[] memory tierConfigs = new TierConfig[]();

tierConfigs[0] = TierConfig({price: 300, amount: 10, minted: 0, power: 12});

tierConfigs[1] = TierConfig({price: 200, amount: 10, minted: 0, power: 6});

tierConfigs[2] = TierConfig({price: 100, amount: 10, minted: 0, power: 3});

DAOConfig memory daoConfig = DAOConfig({

ensname: "testdao.eth",

daoType: DAOType.PUBLIC,

tiers: tierConfigs, // Pass the configured tierConfig array here

currency: address(testERC20),

maxMembers: 100,

noOfTiers: 3

});

DAOInputConfig memory daoInputConfig = DAOInputConfig({

ensname: "testdao.eth",

daoType: DAOType.PUBLIC,

currency: address(testERC20),

maxMembers: 100,

noOfTiers: 3

});

//Give money to alice and bob

testERC20.mint(alice, 1000 * 1e18);

testERC20.mint(bob, 1000 * 1e18);

deal(address(USDC), alice, 1000 * 1e6);

deal(address(USDC), bob, 1000 * 1e6);

deal(address(WBTC), alice, 1000 * 1e8);

deal(address(WBTC), bob, 1000 * 1e8);

deal(address(WETH), alice, 1000 * 1e18);

deal(address(WETH), bob, 1000 * 1e18);

currencyManager.grantRole(currencyManager.ADMIN_ROLE(), alice);

currency1 = address(USDC);

currency2 = address(WBTC);

}

function testUpdateDAOMembershipBug() public {

//Initialize DAO configurations

DAOInputConfig memory daoInputConfig = DAOInputConfig({

ensname: "testdao.eth",

daoType: DAOType.SPONSORED,

currency: address(WBTC),

maxMembers: 100,

noOfTiers: 7

});

// Initialize Tier configurations

TierConfig[] memory tierConfigs = new TierConfig[]();

tierConfigs[0] = TierConfig({price: 700, amount: 10, minted: 0, power: 128});

tierConfigs[1] = TierConfig({price: 600, amount: 10, minted: 0, power: 64});

tierConfigs[2] = TierConfig({price: 500, amount: 10, minted: 0, power: 32});

tierConfigs[3] = TierConfig({price: 400, amount: 10, minted: 0, power: 16});

tierConfigs[4] = TierConfig({price: 300, amount: 10, minted: 0, power: 8});

tierConfigs[5] = TierConfig({price: 200, amount: 10, minted: 0, power: 4});

tierConfigs[6] = TierConfig({price: 100, amount: 10, minted: 0, power: 2});

// Add currency to CurrencyManager

currencyManager.addCurrency(address(WBTC));

// Create new DAO Membership

address daoAddress = membershipFactory.createNewDAOMembership(daoInputConfig, tierConfigs);

//Alice and Bob approve WBTC

vm.prank(alice);

WBTC.approve(address(membershipFactory), 1000000);

vm.prank(bob);

WBTC.approve(address(membershipFactory), 1000000);

// Alice joins DAO 4 times to have 4 tokens tier 6

vm.prank(alice);