Project

Summary

In MemberShipFactory.sol , right now whenever user will user will upgrade it to upper tier by burning his double tokens of lower tier, no of minted amount is done for the tier he upgrades to, but the amount not increases. And whenever he had joineed lower tier , amount had get ++ but when he upgrades amount of minted in lower tier doesnt get subtracted

Vulnerability Details

lets take one example.

3 tiers are there indexed [0,1,2]

each has 50 max amount.

so now indexed tier 2 has 50 tokens with weightage 1. so 50 weigtage
tier 1 has 50*2= 100 weightage

tier 0 has 50*4 = 200 weightage

total 350

Now , if user upgrades from tier 2 to tier 1 by burning 20 tokens ( wiegtage 20) and get minted with 10 tier 1 tokens ( wightage 20)

in this case . weightage persist ,by the problem occurs,

max amount in each tier is 50, if 20 get burn then 20 ( should be subtracted from amount)slot should be open for the users who have to join lower tier. And should be added amount in tier 1.

otherwise there can be the case where max amount in tier 1 is 50 but after upgrade it can exceed 50 too.

this can cause problem in mAx Members situtaion too

Impact

Blocking of slots of lower tiers and max amount in tier also doesn't persist

Tools Used

Manual

Recommendations

Readjustment of tier when mint and burn will happen