Lines of code
<https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/gatekeepers/TokenGateKeeper.sol#L31-L38&gt;

Vulnerability details

Impact

Users, don’t have a Token for contribution but they can bypass this check easy

Proof of Concept

If the Crowdfund is private by using TokenGateKeeper.sol
The contributor can contribution and then send the NFT or ERC20 to another user address. So two users or more can send a contribution with the same Token TO BYPASS isAllowed()

Recommended Mitigation Steps

If it uses NFT you can track the ids

The text was updated successfully, but these errors were encountered:

All reactions