Project

Summary

The updateDAOMembership function in MembershipFactory allows updating tier configurations without validating if the new tier amount can accommodate already minted tokens. This could result in an invalid state where the number of minted tokens exceeds the maximum allowed amount for a tier.

Vulnerability Details

In the updateDAOMembership function of MembershipFactory contract, when updating tier configurations, the function preserves the existing minted values but does not validate if the new tier amount is sufficient to accommodate these minted tokens:

This lack of validation could lead to scenarios where:

1. A tier initially has amount=100 and minted=80

2. An EXTERNAL_CALLER updates the tier configuration with amount=50

3. The new state becomes amount=50, minted=80

4. This creates an invalid state where there are more minted tokens than the maximum allowed

The function should validate that each tier's amount is greater than or equal to its minted value before allowing the update to proceed.

Impact

The vulnerability can cause several issues in the DAO membership system:

1.Data Integrity

• Creates an invalid state where minted tokens exceed the maximum allowed amount

• Breaks the fundamental invariant that tier.minted <= tier.amount

• Could lead to incorrect calculations and decision-making in other contract functions

2.Business Logic Disruption

• The joinDAO function relies on checking tiers[tierIndex].amount > tiers[tierIndex].minted to determine if a tier is full

• With invalid states, tier availability calculations become incorrect

• May prevent legitimate users from joining tiers that should be available

• Could affect profit distribution calculations that depend on tier amounts

3.Sponsored DAO Impact

• For sponsored DAOs, the upgrade mechanism could be affected

• Users might be unable to properly upgrade their tiers due to incorrect tier amount tracking

• Impacts the fairness and intended operation of the tier system

Tools Used

Manual Review

Recommendations

To fix this vulnerability, implement the following changes in the updateDAOMembership function: