Summary

The graduateAndUpgrade function does not validate whether students meet the cutOffScore before allowing system upgrades. This violates the invariant that only students with scores ≥ cutOffScore should progress.

Vulnerability Details

Key Issues:

1. No Score Checks During Upgrade:

   • The graduateAndUpgrade function lacks logic to verify studentScore[student] >= cutOffScore.

   • Example: A student with a score of 50 (below a cutOffScore of 70) will still be included in the upgrade.

Impact

• Invalid Graduations: Students below the cutOffScore can graduate, undermining academic standards.

• Protocol Integrity Loss: The system fails to enforce its core eligibility rule, eroding trust.

Tools Used

Manual code review

Recommendations

1. Add CutOff Validation in graduateAndUpgrade. Note that you cannot directly iterate over the student list to check if they meet the cut off since this will lead to a Dos if the array gets too big, I recommend adding a state to the contract that checks if all student score has been validated. This state will be toggoled by a function that allows this validation to occur in batches.