Use of CREATE method is suspicious of reorg attack
Summary
Creating a new MembershipERC1155 through the MembershipFactory::createNewDAOMembership is susceptible to reorg attacks.
Vulnerability Details
Using the CREATE method and having in mind that the contracts will be deployed to Polygon, which is a chain that have had a block reorg events, can lead to funds being send to a DAO be stolen.
Proof of Concept
Consider the following scenario:
Alice create a DAO.
Block reorg is happening.
Bob creates DAO with the same address of which the Alice's should have been.
Bob is the creator of Alice's DAO.
Links to similar issues reported in Solodit: 1, 2
Tools Used
Manual Review
Recommendations
Use CREATE2 with salt that includes the msg.sender.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.