Project

Summary

DAO creator can be frontrunned by another user and register a DAO with the same ENS name effectively stopping the first user.

Vulnerability Details

The require statement checks for provided ENS name, but everyone can provide whatever ENS name it wants. Thus registering an ENS name that it doesnt own.

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L60

Impact

Real owners of ENS name cant register a DAO

Tools Used

manual

Recommendations

Use ENSRegistry or ENSRoot contract to check if msg.sender is owner of the ensname