Party DAO - pep7siup's results

Lines of code

https://github.com/code-423n4/2023-10-party/tree/main/contracts/party/PartyGovernanceNFT.sol#L208 https://github.com/code-423n4/2023-10-party/tree/main/contracts/party/PartyGovernanceNFT.sol#L236 https://github.com/code-423n4/2023-10-party/tree/main/contracts/party/PartyGovernanceNFT.sol#L247 https://github.com/code-423n4/2023-10-party/tree/main/contracts/party/PartyGovernanceNFT.sol#L255 https://github.com/code-423n4/2023-10-party/blob/main/contracts/renderers/PartyNFTRenderer.sol#L294

Vulnerability details

Impact

PartyGovernanceNFT does not comply with ERC4906 specifications. Failing to uphold ERC4906 standards means that third-party platforms and services are not properly informed when the governance NFT metadata has been updated. This lack of compliance can lead to interoperability issues.

Proof of Concept

The PartyGovernance contract, as stated in README.md, should comply with ERC4906. As PartyGovernanceNFT inherits the PartyGovernance contract, all parent compliances should be passed on to the child contract.

// File: README.md
119:-	The protocol is designed to comply with several Ethereum Improvement Proposals (EIPs). Following contracts should be in compliance:
120:  - `PartyGovernance`: Should comply with `ERC4906` // <= FOUND
121:  - `PartyGovernance`: Should comply with `ERC165`
122:  - `PartyGovernanceNFT`: Should comply with `ERC2981`
123:  - `PartyGovernanceNFT`: Should comply with `ERC721`
124:  - `PartyGovernanceNFT`: Should comply with `ERC165`
  ...

That being said, some of PartyGovernanceNFT's functions do not adhere to ERC4906 standards, which require the emission of MetadataUpdate or BatchMetadataUpdate events for all actions that update token metadata. Specifically, the functions in question include increaseVotingPower, decreaseVotingPower, decreaseTotalVotingPower, and increaseTotalVotingPower. These functions affect the metadata, as demonstrated in the PartyNFTRenderer.tokenURI function below, where the generateVotingPowerPercentage is used to compute the up-to-date URI and the metadata embedded within it.

// File: contracts/renderers/PartyNFTRenderer.sol
157:    function tokenURI(uint256 tokenId) external view returns (string memory) {
        ...
219:              ? generateDescription(PartyGovernanceNFT(address(this)).name(), tokenId) // <= FOUND
223:    }
        ...
286:    function generateDescription(
        ...
292:                string.concat(
293:                    "This membership represents ",
294:                    generateVotingPowerPercentage(tokenId), // <= FOUND
295:                    "% voting power in ",
296:                    partyName,
297:                    ". Head to ",
298:                    generateExternalURL(),
        ...
311:    }

Tools Used

Manual Review

Recommended Mitigation Steps

Emit the required MetadataUpdate or BatchMetadataUpdate events when metadata is updated in abovementioned functions.

Assessed type

Other