Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

High Severity - Unlimited Reviews in `LevelOne::giveReview` (Missing reviewCount Increment + Unfair Score Manipulation)

0xsnoweth

Summary

ThegiveReview function fails to increment reviewCount, rendering the reviewCount[_student] < 5 check ineffective. This allows teachers to submit unlimited reviews, excessively manipulating student scores.

Vulnerability Details

  • Root Cause: The reviewCount[_student] mapping is never incremented in giveReview, so the check always passes.

  • Attack Path: A teacher repeatedly calls giveReview with review = false, reducing a student’s score indefinitely.

  • Affected Component: The review system, specifically reviewCount and score calculation.

Proof of Concept:

function test\_unlimited\_reviews() public schoolInSession {
for (uint i = 0; i < 10; i++) {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
}
assertEq(levelOneProxy.studentScore(harriet), 0); // Expect 0 after 10 reviews
}
​
-
​

Impact

  • Unfair Score Manipulation: Students can be unfairly prevented from graduating by excessive score reductions.

  • Core Mechanic Violation: Breaks the 4-review limit, undermining system fairness.

Tools Used

Manual Review

Recommendations

Increment reviewCount and adjust the check for clarity. Here’s the diff:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
- require(reviewCount[_student] < 5, "Student review count exceeded!!!");
+ require(reviewCount[_student] < 4, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
+ reviewCount[_student] += 1;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 15 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

yeahchibyke Lead Judge 15 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.