Submission Details
Severity:
User can overpay a price for joining a DAO
Summary
Joining a DAO is calling joinDAO and then transfering tokens from users wallet to the Membership contract, but it can be frontrunned by updating the price of a tier and thus making the user pay more than he is willing to
Vulnerability Details
Impact
Unhappy users because they overpayed for a tier
Tools Used
manual review
Recommendations
Add maximum price parameter for a user when calling joinDAO and check if tierPrice is less than or equal to maximum price sent by user
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.