Summary

The giveReview function in the LevelOne contract enforces a one-week cooldown between reviews and purports to limit each student to five total reviews, but it never increments the reviewCount mapping. As a result, a teacher can call giveReview indefinitely on the same student—one time per week—completely bypassing the intended four-review cap.

Vulnerability Details

The code checks two conditions before recording a review: that the caller is a teacher and that fewer than five reviews have been given (require(reviewCount[_student] < 5, "Student review count exceeded!!!")), and that at least one week has passed since the last review (require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week")). However, after passing these checks and adjusting the student’s score and lastReviewTime, the function never increments reviewCount[_student]. Consequently, the five-review limit is never reached and the count check remains perpetually true.

Impact

A malicious or compromised teacher can indefinitely penalize or reward a student beyond the intended limit, potentially manipulating student scores and graduation eligibility. The effect undermines fairness and trust in the system’s academic logic but does not directly steal funds. Exploitation requires only teacher privileges and weekly calls, making it straightforward once a teacher account is available.

Proof Of Concept

The following test proves that we can review a student more than 4 times without reverting:

Tools Used

• Foundry

• Manual Review

Recommendations

To restore both the weekly-rate and total-count invariants, update giveReview as follows:

1. Introduce a separate counter for weekly reviews, resetting it when a new week begins.

1. Increment the total-review counter and enforce the five-review cap.