Submission Details
Severity:
[M-01] Users who created a new DAO memberships cannot update DAO membership
Summary
Any user can create a new DAO membership. Users are unable to update their membership using MembershipFactory::updateDAOMembership because of access modifier onlyRole(EXTERNAL_CALLER) applied to the method.
Vulnerability Details
function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
external onlyRole(EXTERNAL_CALLER) returns (address) {
address daoAddress = getENSAddress[ensName];
Impact
A user cannot modify their own created DAO membership. This violates the main functionality of the protocol.
Tools Used
Manual analysis
Recommendations
Remove the onlyRole(EXTERNAL_CALLER)modifier so that users can update DAO memberships
-function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
- external onlyRole(EXTERNAL_CALLER) returns (address) {
+function updateDAOMembership(string calldata ensName, TierConfig[] memory tierConfigs)
+ external returns (address) {
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.