Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Upgraded tiers are not counted in minted amount

amarfares

Summary

Upgraded tiers are not counted in minted amount

Vulnerability Details

DAO's of type SPONSORED have 7 tiers. Users can exchange 2 tokens of a lesser tier to upgrade into the higiher one. The issue is that when that is done, the protocol does not internally account for the tokens as minted:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

But if we look at how we join a DAO, we will see it properly internally accounted:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

Impact

When users upgrade to a higher tier, the minted slots are not filled up although the token is in fact minted. This would allow users to surpass a tier's max minted tokens limit.

Example:

Tier A - Limit 10 tokens:

  1. Alice upgrades 20 tokens of the lesser tier by burning them and now has 10 Tier A Tokens

  2. Alice also directly calls joinDAO and mints additional 10 Tier A Tokens

Alice now has 20 Tier A tokens, while the max limit is 10.

Tools Used

Manual Review

Recommendations

Count the upgraded tiers as minted

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.