Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Loss to early users who joined DAO early.

smbv1923

Summary

  • Users who joined early into DAO would be suffering loss indirectly

Vulnerability Details

  • Lets suppose a DAO has been created.

  • UserA joins the DAO through joinDAO() when there were no sendProfit() called inside Memsheership1155 contract of that DAO.

  • Now other users (UserB,UserC) as well join the DAO when no sendProfit() was called .

  • Lets say after 10 days sendProfit() is called and userD joined after sendProfit()

  • Now until another sendPrableofit() is called all users would be able to claim same amount of prize token according to their propotion

  • This is a clear loss to UserA, UserB , UserC as even though he joined DAO earlier but is able to claim same amount as of UserD.

  • There is no motivation to joinDao early and because of this bug every user would join the DAO after the sendProfit() has been called.

  • This also has implications because if there no users while sendProfit() then all profit goes to creator of DAO, so each user would wait for another user to join DAO and for sendProfits() to get call.

function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
} else {
IERC20(currency).safeTransferFrom(msg.sender, creator, amount); // Redirect profit to creator if no supply
}
}

Impact

  • Loss to users who joined the DAO early as they will receive same profit tokens in comparison to user who joined DAO after sendProfit() has been called.

Tools Used

Manual Review

Recommendations

  • Make logic such that the early user should get more tokens to the user who joined after the sendProfit() gets called.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.