Project

Vulnerability Details

Steps of the Attack:

• Frontrun:

The attacker monitors the blockchain for a transaction that calls the sendProfit function and totalSupply is 0.
Then frontrun it by buying say the lowest tier token, ensuring that totalSupply is now greater than zero.

• Profit Distribution:

The sendProfit function is executed, and since totalSupply is now greater than zero, the profit is distributed among token holders, which are the attacker only in this case.

• Backrun:

Immediately after the profit distribution, the attacker backruns sendProfit with claimProfit function, effectively claiming all the profit.

contracts/dao/tokens/MembershipERC1155.sol#L198

Impact

Attacker can take all profit when calling MembershipERC1155::sendProfit and total supply is 0.

Tools Used

Recommendations

One way to fix this is to add a minimum holding period before being able to sell.