Submission Details
Severity:
Minted tokens not preserved in case `tierConfigs.length < dao.tiers.length` if using `MembershipFactory::updateDAOMembership` function
Relevant GitHub Links
https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/MembershipFactory.sol#L114-L133
Summary
In case tierConfigs.length < dao.tiers.length using MembershipFactory::updateDAOMembership tokens of the tiers that exceed are not preserved, and lost forever.
Vulnerability Details
Minted tokens are deleted, and not preserved updating the memerbership of the DAO
for (uint256 i = 0; i < tierConfigs.length; i++) {
if (i < dao.tiers.length) {
tierConfigs[i].minted = dao.tiers[i].minted;
}
}
// Reset and update the tiers array
delete dao.tiers;
for (uint256 i = 0; i < tierConfigs.length; i++) {
dao.tiers.push(tierConfigs[i]);
maxMembers += tierConfigs[i].amount;
}
// updating the ceiling limit acc to new data
if(maxMembers > dao.maxMembers){
dao.maxMembers = maxMembers;
}
dao.noOfTiers = tierConfigs.length;
return daoAddress;
Impact
Minted tokens that represent share of the DAO profit for the user are not preserved.
Tools Used
Manual review
Recommendations
Add a require statement that new number of tiers should be >= old one.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.