Audit fix/sybil attack enhancements#24

src/core/ElasticDAO.sol

@@ -199,8 +199,6 @@ contract ElasticDAO is ReentryProtection {
    * Based on the current state of the DAO, capitalDelta, deltaE, mDash are calulated,
    * after which  _deltaLambda is minted for the address calling the function.
    *
-   * @param _deltaLambda - the amount of lambda minted to the address
-   *
    * @dev documentation and further math regarding capitalDelta, deltaE,
    * mDash can be found at ../libraries/ElasticMath.sol
    * @dev emits the JoinDAO event
@@ -212,7 +210,7 @@ contract ElasticDAO is ReentryProtection {
    * must be sent in the transaction by the calling address
    * The token contract should be successfully be able to mint  _deltaLambda
    */
-  function join(uint256 _deltaLambda)
+  function join()
     external
     payable
     onlyAfterSummoning
@@ -221,10 +219,6 @@ contract ElasticDAO is ReentryProtection {
   {
     Token.Instance memory token = _getToken();
 
-    require(
-      _deltaLambda <= token.maxLambdaPurchase,
-      'ElasticDAO: Cannot purchase those many lambda at once'
-    );
 
     ElasticGovernanceToken tokenContract = ElasticGovernanceToken(token.uuid);
     uint256 capitalDelta =
@@ -236,20 +230,18 @@ contract ElasticDAO is ReentryProtection {
       );
     uint256 deltaE =
       ElasticMath.deltaE(
-        _deltaLambda,
+        token.maxLambdaPurchase,
         capitalDelta,
         token.k,
         token.elasticity,
         token.lambda,
         token.m
       );
 
-    if (deltaE != msg.value) {
-      revert('ElasticDAO: Incorrect ETH amount');
-    }
+    require(msg.value >= deltaE, 'ElasticDAO: Incorrect ETH amount');
 
     // mdash
-    uint256 lambdaDash = SafeMath.add(_deltaLambda, token.lambda);
+    uint256 lambdaDash = SafeMath.add(token.maxLambdaPurchase, token.lambda);
     uint256 mDash = ElasticMath.mDash(lambdaDash, token.lambda, token.m);
 
     // serialize the token
@@ -259,9 +251,16 @@ contract ElasticDAO is ReentryProtection {
     tokenStorage.serialize(token);
 
     // tokencontract mint shares
-    bool success = tokenContract.mintShares(msg.sender, _deltaLambda);
+    bool success = tokenContract.mintShares(msg.sender, token.maxLambdaPurchase);
     require(success, 'ElasticDAO: Mint Shares Failed during Join');
-    emit JoinDAO(msg.sender, _deltaLambda, msg.value);
+
+    // return extra ETH
+    if(success && msg.value > deltaE) {
+      (success, ) = msg.sender.call{ value: SafeMath.sub(msg.value, deltaE) }('');
+      require(success, 'ElasticDAO: TransactionFailed');
+    }
+
+    emit JoinDAO(msg.sender, token.maxLambdaPurchase, msg.value);
   }
 
   /**

test/capitalDeltaTest.js

@@ -1,7 +1,6 @@
 const { expect } = require('chai');
 
 const { capitalDelta, deltaE, mDash } = require('@elastic-dao/sdk');
-const BigNumber = require('bignumber.js');
 
 const { ONE } = require('./constants');
 const { ethBalance, signers, summonedDAO } = require('./helpers');
@@ -30,10 +29,17 @@ describe('ElasticDAO: CapitalDelta value of a token', () => {
 
     // calculate deltaE using capital Delta to buy ONE_TENTH shares
     // deltaE = capitalDelta * k  * ( (lambdaDash*mDash*revamp) - (lambda*m) )
-    const dE = deltaE(0.1, cDelta, token.k, token.elasticity, token.lambda, token.m);
+    const dE = deltaE(
+      token.maxLambdaPurchase,
+      cDelta,
+      token.k,
+      token.elasticity,
+      token.lambda,
+      token.m,
+    );
 
     // send that value of deltaE to joinDAO to buy ONE_TENTH shares
-    const tx = dao.elasticDAO.join(0.1, { value: dE });
+    const tx = dao.elasticDAO.join({ value: dE });
 
     // transaction reverts with 'ElasticDAO: Incorrect ETH amount'
     await expect(tx).to.be.revertedWith('ElasticDAO: Incorrect ETH amount');
@@ -53,13 +59,20 @@ describe('ElasticDAO: CapitalDelta value of a token', () => {
 
     // calculate deltaE using capital Delta to buy ONE_TENTH shares
     // deltaE = capitalDelta * k  * ( (lambdaDash*mDash*revamp) - (lambda*m) )
-    const deltaLambda = BigNumber(0.1);
-    const lambdaDash = token.lambda.plus(deltaLambda);
-    const dE = deltaE(deltaLambda, cDelta, token.k, token.elasticity, token.lambda, token.m);
+    const lambdaDash = token.lambda.plus(token.maxLambdaPurchase);
+    const dE = deltaE(
+      token.maxLambdaPurchase,
+      cDelta,
+      token.k,
+      token.elasticity,
+      token.lambda,
+      token.m,
+    );
+
     const mD = mDash(lambdaDash, token.lambda, token.m);
 
-    // send that value of deltaE to joinDAO to buy ONE_TENTH shares
-    await dao.elasticDAO.join(deltaLambda, { value: dE });
+    // send that value of deltaE to joinDAO to buy ONE share
+    await dao.elasticDAO.join({ value: dE });
     await token.refresh();
 
     // post join check the following values:

test/elasticDAOTests.js

@@ -1,5 +1,6 @@
 const { expect } = require('chai');
 const { ethers } = require('ethers');
+const { capitalDelta, deltaE, mDash } = require('@elastic-dao/sdk');
 const { deployments } = require('hardhat');
 const hre = require('hardhat').ethers;
 const { ethBalance, SDK, signers, summoners, summonedDAO } = require('./helpers');
@@ -399,5 +400,49 @@ describe('ElasticDAO: Core', () => {
         }
       }
     });
+
+    it('Should allow a new member to join as long as they send more ETH than deltaE', async () => {
+      dao = await summonedDAO();
+      const token = await dao.token();
+      // get the eth balance of elasticDAO
+      const ethBalanceElasticDAOBeforeJoin = await ethBalance(dao.uuid);
+
+      // get the T value of the token
+      const totalSupplyOfToken = await dao.elasticGovernanceToken.totalSupply();
+
+      // calculate capital Delta
+      const cDelta = capitalDelta(ethBalanceElasticDAOBeforeJoin, totalSupplyOfToken);
+
+      // calculate deltaE using capital Delta to buy ONE_TENTH shares
+      // deltaE = capitalDelta * k  * ( (lambdaDash*mDash*revamp) - (lambda*m) )
+      const lambdaDash = token.lambda.plus(token.maxLambdaPurchase);
+      const dE = deltaE(
+        token.maxLambdaPurchase,
+        cDelta,
+        token.k,
+        token.elasticity,
+        token.lambda,
+        token.m,
+      );
+
+      const mD = mDash(lambdaDash, token.lambda, token.m);
+
+      // send that value of deltaE to joinDAO to buy ONE share + 1
+      await dao.elasticDAO.join({ value: dE.plus(1) });
+      await token.refresh();
+
+      // post join check the following values:
+      // check the m value- after join,previous mDash should be current m
+      await expect(token.m.toString()).to.equal(mD.toString());
+      await expect(token.lambda.toString()).to.equal(lambdaDash.toString());
+
+      // check the the total eth - which should be initial eth, plus delta e
+      const ethBalanceElasticDAOAfterJoin = await ethBalance(dao.uuid);
+
+      const expectedEthInElasticDAOAfterJoin = ethBalanceElasticDAOBeforeJoin.plus(dE);
+      await expect(ethBalanceElasticDAOAfterJoin.toString()).to.equal(
+        expectedEthInElasticDAOAfterJoin.toString(),
+      );
+    });
   });
 });