fix-03: track redeemed coupons

contracts/adapters/KycOnboarding.sol

@@ -79,6 +79,7 @@ contract KycOnboardingContract is
     IERC20 private _weth20;
 
     mapping(DaoRegistry => mapping(address => uint256)) public totalUnits;
+    mapping(bytes => bool) public redeemedCoupons;
 
     constructor(address payable weth) {
         _weth = WETH(weth);
@@ -245,13 +246,15 @@ contract KycOnboardingContract is
             !isActiveMember(dao, dao.getCurrentDelegateKey(kycedMember)),
             "already member"
         );
+        require(!redeemedCoupons[signature], "already redeemed");
         uint256 maxMembers = dao.getConfiguration(
             _configKey(tokenAddr, MaxMembers)
         );
         require(maxMembers > 0, "token not configured");
         require(dao.getNbMembers() < maxMembers, "the DAO is full");
 
         _checkKycCoupon(dao, kycedMember, tokenAddr, signature);
+        redeemedCoupons[signature] = true;
 
         OnboardingDetails memory details = _checkData(dao, tokenAddr, amount);
         totalUnits[dao][tokenAddr] += details.unitsRequested;

test/adapters/kyc-onboarding.test.js

@@ -361,4 +361,68 @@ describe("Adapter - KYC Onboarding", () => {
       "too much funds"
     );
   });
+
+  it("should not be possible to rejoin the DAO using a coupon that was already redeemed", async () => {
+    const applicant = accounts[2];
+
+    const dao = this.dao;
+    const bank = this.extensions.bankExt;
+    const onboarding = this.adapters.kycOnboarding;
+    const ragequit = this.adapters.ragequit;
+
+    // remaining amount to test sending back to proposer
+    const ethAmount = unitPrice.mul(toBN(3)).add(remaining);
+
+    const signerUtil = SigUtilSigner(signer.privKey);
+
+    const couponData = {
+      type: "coupon-kyc",
+      kycedMember: applicant,
+    };
+
+    let jsHash = getMessageERC712Hash(
+      couponData,
+      dao.address,
+      onboarding.address,
+      1
+    );
+    let solHash = await onboarding.hashCouponMessage(dao.address, couponData);
+    expect(jsHash).equal(solHash);
+
+    const signature = signerUtil(
+      couponData,
+      dao.address,
+      onboarding.address,
+      1
+    );
+
+    await onboarding.onboardEth(dao.address, applicant, signature, {
+      from: applicant,
+      value: ethAmount,
+      gasPrice: toBN("0"),
+    });
+
+    // test active member status
+    expect(await isMember(bank, applicant)).equal(true);
+
+    // Ragequit - Burn all the member units and exit the DAO
+    const memberUnits = await bank.balanceOf(applicant, UNITS);
+    await ragequit.ragequit(dao.address, memberUnits, toBN(0), [ETH_TOKEN], {
+      from: applicant,
+      gasPrice: toBN("0"),
+    });
+
+    // test active member status
+    expect(await isMember(bank, applicant)).equal(false);
+
+    // Attempt to rejoin the DAO using the same KYC coupon
+    await expectRevert(
+      onboarding.onboardEth(dao.address, applicant, signature, {
+        from: applicant,
+        value: ethAmount,
+        gasPrice: toBN("0"),
+      }),
+      "already redeemed"
+    );
+  });
 });