Summary

The Slither static analyzer has identified four critical state variables in the LevelTwo contract that are declared but never initialized before being used in various getter functions. These variables include principal, listOfStudents, listOfTeachers, and usdc.

Vulnerability Details

Four state variables are declared but never initialized in the LevelTwo contract:

1. principal (line 11): Used in the getPrincipal() function (lines 30-32)

2. listOfStudents (line 19): Used in getTotalStudents() (lines 42-44) and getListOfStudents() (lines 46-48)

3. listOfTeachers (line 20): Used in getTotalTeachers() (lines 38-40) and getListOfTeachers() (lines 50-52)

4. usdc (line 26): Used in getSchoolFeesToken() (lines 34-36)

In Solidity, uninitialized state variables default to their "zero values":

• For principal (likely an address): defaults to address(0)

• For arrays listOfStudents and listOfTeachers: default to empty arrays

• For usdc (likely an ERC20 token address): defaults to address(0)

These default values may lead to unexpected behavior when the getter functions are called, as they will return these default values instead of meaningful data.

Impact

Medium to High. The impact varies based on how these variables are used:

1. principal: If authorization checks rely on this address, security controls might be bypassed.

2. listOfStudents and listOfTeachers: Functions that return these lists or their lengths will return empty arrays/zero counts, potentially breaking frontend integrations or reporting.

3. usdc: If this token address is used for financial operations, attempts to transfer or check balances may fail or revert.

The contract appears to be related to a school management system with financial components, suggesting that these uninitialized variables could affect administrative controls, reporting accuracy, and financial operations.

Tools Used

Slither static analysis tool

Recommendations

Initialize Variables in Constructor or Initialize Function

Add Validation in Getter Functions

Implement Setter Functions with Access Control

Consider Immutability for Critical Variables

If these values should not change after initialization, consider making them immutable for gas optimization and security.

Add Events for Variable Changes