Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing low score check in graduateAndUpgrade() __LevelOne.sol

hawks

Summary

The graduateAndUpgrade function lacks logic to prevent students with low scores from being upgraded, breaking the contract's intended invariant:

"Any student who doesn't meet the cutOffScore should not be upgraded."

Vulnerability Details

The current implementation does not check if a student’s score meets the cutOffScore before allowing graduation. This means students with low or even zero scores can still graduate, violating performance-based progression rules.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
// require(block.timestamp >= sessionEnd, "Session has not ended yet");
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

Impact

Students with insufficient scores can graduate, which is unfair and undermines the scoring system.

Tools Used

Manual review

Recommendations

Add a check to ensure each student meets the minimum required score before proceeding:

for (uint256 i = 0; i < listOfStudents.length; i++) {
address student = listOfStudents[i];
require(studentScore[student] >= cutOffScore, "Student score below required threshold");
}

Updates

Lead Judging Commences

yeahchibyke Lead Judge 17 days ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 17 days ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.