Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

The `Principal` can fire teachers while session is running, preventing teachers from taking their wage (the 35% of all school fees)

mosmoker

Summary

this is a chained bug, where i didn't stop at proving that the owner can remove/fire teachers while session is running, i also chained it with the bug i reported here https://codehawks.cyfrin.io/c/2025-05-hawk-high/s/cma5krvko0003l50445xs8kol, leaving us with a high impact where the owner can take a complete 40% of all the school fees for only theirselves.

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file

2- Add the following PoC code to the test file:

function testIfOwnerCanFireATeacherWhileSessionIsOn() public {
_teachersAdded();
_studentsEnrolled();
vm.prank(principal);
levelOneProxy.addTeacher(principal);
address levelTwo = makeAddr("leveltwo");
​
console2.log(
"All the School Fees --> :",
levelOneProxy.bursary() / 1e18
);
vm.prank(principal);
levelOneProxy.startSession(70);
​
// make sure that the session is on
assertEq(levelOneProxy.getSessionStatus(), true);
​
// notice that the principal is able to remove teachers while the session is on
vm.prank(principal);
levelOneProxy.removeTeacher(alice);
vm.prank(principal);
levelOneProxy.removeTeacher(bob);
​
// The chained impact where A complete 40% of all school fees will be collected by only the principal
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwo, "");
​
assertEq(
usdc.balanceOf(principal),
(levelOneProxy.bursary() * 40) / 100
);
console2.log(
"Principal's balance after removing teachers and update the system : ",
usdc.balanceOf(principal) / 1e18
);
}

3- in the command line, run the following command: forge test --match-test testIfOwnerCanFireATeacherWhileSessionIsOn -vvv

4- the output will be as following :

All the School Fees --> : 30000
Principal's balance after removing teachers and update the system : 12000
​
Suite result: ok. 1 passed; 0 failed; 0 skipped

Impact

the impact of this bug is the Principal can steal all the wage of all teachers for theirself, and instead of taking a 5% of all schook fees as the protocol rules, the Principal will secure a complete 40% of all the school fees which is a critical flaw.

Tools Used

  • Manual Recon

  • foundry test suite

Recommendations

Add the LevelOne::notYetInSession modifier with the LevelOne::removeTeacher function as the following:

+ function removeTeacher(address _teacher) public onlyPrincipal notYetInSession {
FUNCTION_LOGIC_HERE
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Design choice
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.