Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Medium Severity - Post-Session Reviews in `OneLevel::giveReview` (Missing `sessionEnd` Check + Unfair Score Changes)

0xsnoweth

Summary

he giveReview function lacks a check to prevent reviews after sessionEnd, allowing teachers to submit reviews post-session, which can unfairly alter student scores before the upgrade.

Vulnerability Details

  • Root Cause: No check for block.timestamp <= sessionEnd in giveReview.

  • Attack Path: A teacher submits a review after sessionEnd but before graduateAndUpgrade, lowering a student’s score below cutOffScore.

  • Affected Component: The review system’s timing logic.

Proof of Concept

function test_review_after_session_end() public schoolInSession {
vm.warp(block.timestamp + 5 weeks); // After sessionEnd
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assertEq(levelOneProxy.studentScore(harriet), 90); // Score should not change
}

  • Expected: Review reverts as the session has ended.

  • Actual: Review succeeds, lowering the score to 90.

Impact

  • Unfair Score Changes: Prevents students from graduating by late score manipulation.

  • Rule Violation: Breaks the rule that reviews should only occur during the session.

Tools Used

Manual Review

Recommendations

Add a sessionEnd check. Here’s the diff:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 4, "Student review count exceeded!!!");
+ require(block.timestamp <= sessionEnd, "Session has ended");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
reviewCount[_student] += 1;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 17 days ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.