Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`LevelTwo::graduate` is not called upon school system upgrade (`LevelOne::graduateAndUpgrade`), allowing anyone to call `LevelTwo::graduate` and initialize the contract

37h3rn17y2

Summary

LevelTwo::graduate has a reinitializer(2) modifier, which restricts the function to be called only once. It is expected to be called by LevelOne::graduateAndUpgrade through GraduateToLevelTwo.s.sol. However, LevelOne::graduateAndUpgrade does not utilize the (bytes memory)data field for the external call to LevelTwo::graduate. As a result, LevelTwo is not (re)initialized and anyone can call LevelTwo::graduate to (re)initialize it.

LevelOne::graduateAndUpgrade#L295

@> function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {

Impact

Impact: Low, students still can graduate if anyone calls LevelTwo::graduate
Likelihood: High, principal will upgrade school system at the end of school session (after 4 weeks)
Severity: Low

Tools Used

Manual review

Recommendations

Make the following modifications

LevelOne::graduateAndUpgrade

+ function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
- function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
+ upgradeToAndCall(_levelTwo, data)
- _authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.