Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

[M-3] MembershipFactory.sol does not have the OWP_FACTORY_ROLE, therefore cannot call burn::MembershipERC1155 in upgradeTier

oluwaseyisekoni

Summary

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
//@audit can only be called by OWP_FACTORY_ROLE
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

Vulnerability Details

burn::MembershipERC1155.solhas a modifier OWP_FACTORY_ROLE, the upgradeTier::MembershipFcactory.solwill revert if the contract MembershipFactory.sol calls IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2)

Impact

Users will not be able to upgradeTiers or mint NFTs

Tools Used

Manual review

Recommendations

MembershipERC1155.solshould granted OWP_FACTORY_ROLErole

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.