Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Upgraded tiers are not counted in minted amount

amarfares

Summary

Upgraded tiers are not counted in minted amount

Vulnerability Details

DAO's of type SPONSORED have 7 tiers. Users can exchange 2 tokens of a lesser tier to upgrade into the higiher one. The issue is that when that is done, the protocol does not internally account for the tokens as minted:

function upgradeTier(address daoMembershipAddress, uint256 fromTierIndex) external {
require(daos[daoMembershipAddress].daoType == DAOType.SPONSORED, "Upgrade not allowed.");
require(daos[daoMembershipAddress].noOfTiers >= fromTierIndex + 1, "No higher tier available.");
IMembershipERC1155(daoMembershipAddress).burn(_msgSender(), fromTierIndex, 2);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), fromTierIndex - 1, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, fromTierIndex - 1);
}

But if we look at how we join a DAO, we will see it properly internally accounted:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

Impact

When users upgrade to a higher tier, the minted slots are not filled up although the token is in fact minted. This would allow users to surpass a tier's max minted tokens limit.

Example:

Tier A - Limit 10 tokens:

  1. Alice upgrades 20 tokens of the lesser tier by burning them and now has 10 Tier A Tokens

  2. Alice also directly calls joinDAO and mints additional 10 Tier A Tokens

Alice now has 20 Tier A tokens, while the max limit is 10.

Tools Used

Manual Review

Recommendations

Count the upgraded tiers as minted

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.