Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The Principal can add theirself as a teacher, sharing with all other teachers the 35% of all fees in addition to their fixed 5% fees

mosmoker

Summary

This is a logic bug where the Principal will not only get paid by 5% of all school fees, but also they will share with the other teachers the 35% of all school fees. giving the Principal the ability to Increase their earning above what they suppose to get paid.

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file

2- add the following PoC code to the test file:

function testPrincipalCanBeATeacher() public {
address randomTeacherAdddress = makeAddr("some random teacher address");
​
vm.prank(principal);
levelOneProxy.addTeacher(randomTeacherAdddress);
vm.prank(principal);
levelOneProxy.addTeacher(principal);
​
assert(levelOneProxy.getTotalTeachers() == 2);
​
assertEq(levelOneProxy.isTeacher(randomTeacherAdddress), true);
assertEq(levelOneProxy.isTeacher(principal), true);
}
​

3- in the command line, run the following command: forge test --match-test testPrincipalCanBeATeacher -vvv

4- the output will be as following --> Suite result: ok. 1 passed; 0 failed; 0 skipped

Impact

sharing with other teachers their fees will decrease the other teachers earning which is for sure is not indented by the protocol, in the same time it will increase the Principal total earning after every session than it supposed to be, which is in both cases breaks the protocol rules and implementations.

Tools Used

  • manual Recon

  • foundry test suite

Recommendations

add a restriction to force preventing that the Principal to be a part of listOfTeachers in the LevelOne::addTeacher function, for example as following

+ if (_teacher == principal) {
+ revert HH__NotAllowed();
+ }
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

principal can become teacher

Principal can add themselves as teacher and share in teacher pay upon graduation

yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

principal can become teacher

Principal can add themselves as teacher and share in teacher pay upon graduation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.