Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

All the creator profit can be stolen with minimum amount.

0xsandy

Summary

When the totalSupplyis zero, the profit sent to the MembershipERC1155.solcontract is all transferred to the creator. But it can be stolen by an attacker.

Vulnerability Details

The sendProfit()function transfers all the profit to the creatorif the totalSupplyis 0.

function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
} else {
IERC20(currency).safeTransferFrom(msg.sender, creator, amount); // Redirect profit to creator if no supply
}
}

totalSupply increases when someone joins a DAO using the joinDAO() function of MembershipFactory.sol as it mints the MembershipERC1155 tokens which in turn increase the total supply.

Consider this scenario:

  1. Alice is the creator of a DAO.

  2. For some reason, the total supply of the DAO becomes 0 or Nobody joins the DAO.

  3. Now the sendProfit() function is called to send profit to the DAO.

  4. A malicious user sees this transaction and front-run the sendProfit() function with joinDAO function to increase the total supply by paying the minimum tier price.

Note: The malicious user can join the DAO in any tier.

5.Now the sendProfit() function instead of transferring the profit to the creator, it increases the totalProfit of the contract and now the malicious user will be able to claim all the profit from the contract.

function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
}
...

Note: All the profit can be claimed by the malicious user as he/she has all the totalSupply.

Impact

All the profit of the creator can be stolen by a malicious user by paying minimum tier price amount and thus the high severity.

Tools Used

Manual Analysis

Recommendations

Add a seperate function to transfer the profit to the creator instead of doing that in the sendProfit() function.

Example:

./MembershipERC1155.sol
​
function sendProftToCreatorIfTotalSupplyZero(uint256 amount) external {
IERC20(currency).safeTransferFrom(msg.sender, creator, amount);
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.