Summary

The contract defines an event Graduated, but it is never emitted anywhere in the codebase. This limits transparency and makes it harder to track upgrades or student graduation on-chain.

Vulnerability Details

The following event is declared:

However, the graduateAndUpgrade function — which logically represents the point of student graduation and upgrade — does not emit an event.

Impact

Makes auditing and monitoring harder, reducing overall transparency

Off-chain systems (indexers, dashboards, analytics) cannot detect when graduation occurs

Tools Used

Manual review

Recommendations

Emit the Graduated event inside graduateAndUpgrade() after a successful upgrade: