Project

Summary

in callExternalContract method there is no check if the receiving contract is actually a smart contract when data parameter is not empty.

Vulnerability Details

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L177

calling contract address that is not smart contract with non empty calldata will return success.

Impact

Unexpected behavior by the caller.

Tools Used

manual review

Recommendations

add check on line https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L177

`if (data.length > 0) {

require(contractAddress.code.length > 0, "contract is not smart contract");

}
`