Project

Summary

There is an oversight in updateDAOMembership(string, TierConfig[]) which does not accordingly update the dao.maxMembers.

Vulnerability Details

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/MembershipFactory.sol#L127C1-L130C10

Code snippet shows that dao.maxMembers is only updated when maxMembers is greater than dao.maxMembers. When maxMembers is LOWER than dao.maxMembers - then the dao.maxMembers state variable does NOT update.

Impact

More members than can exist in a DAO than is stored at dao.maxMembers under the condition the amount of members is lowered at some point. We see it is not used on contracts for verification - but on backend hence the MEDIUM severity tag.

Tools Used

Manual review

Recommendations

Update dao.maxMembers in cases where the addition of members does not add up to the previous state variable value. Write the code snippet as follows: