Summary

A missing enforcement of both the cutoff‑score and the required four weekly reviews in the graduateAndUpgrade function allows under‑performing and under‑reviewed students to advance.

Vulnerability Details

The graduateAndUpgrade routine contains no logic to exclude students whose studentScore falls below cutOffScore nor any guardrail to ensure each student has received at least four giveReview calls before upgrading. As a result, every enrolled student—regardless of score or number of reviews—gets migrated into LevelTwo without filtering or validation.

Impact

Any student can graduate no matter their score or number of reviews.

Tools Used

• Foundry

• Manual Review

Proof of Concept

Place the following test in LevelOneAndGraduateTest.t.sol:

Recommendations

Consider adding a pre‑upgrade filter in graduateAndUpgrade that iterates through listOfStudents, checks each student’s studentScore and reviewCount, and for anyone who falls below cutOffScore or hasn’t hit four reviews, deletes their mapping entries and removes them from the array so they can’t be migrated to LevelTwo.

Bellow is an example:

• 
  ```diff function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal { if (_levelTwo == address(0)) { revert HH__ZeroAddress(); }

  •    for (uint256 i = 0; i < listOfStudents.length; i++) {
    

  •        address s = listOfStudents[i];
    

  •        // drop anyone below cutoff or with fewer than 4 reviews
    

  •        if (studentScore[s] < cutOffScore || reviewCount[s] < 4) {
    

  •            // mark as no longer a student
    

  •            isStudent[s] = false;
    

  •            // clear their score and review count
    

  •            delete studentScore[s];      
    

  •            delete reviewCount[s];
    

  •            // remove from array by swapping in last element
    

  •            listOfStudents[i] = listOfStudents[listOfStudents.length - 1];
    

  •            listOfStudents.pop();        
    

  •            i--;  
    

  •        }
    

  •    }
    
    .....rest of code.....
    

  ​