Invariant Violation — Teacher Wage Increase from 35% To 40% on System Upgrade
Summary
An invariant in the Hawk High School protocol specifies that only 40% of bursary funds (35% to teachers + 5% to principal) should be distributed during the graduateAndUpgrade() function call, leaving 60% of the bursary in the contract post-upgrade.
However, due to a discrepancy between LevelOne and LevelTwo contract constants, the teacher wage increases from 35% → 40% after upgrade.
If this higher percentage were mistakenly applied during the upgrade process itself, it could result in a 45% total bursary payout, violating protocol invariants and leading to fund misallocation.
Vulnerability Details
| Contract | Function | Line(s) | Issue |
|---|---|---|---|
LevelOne |
graduateAndUpgrade() |
L~363 | Payout logic assumes TEACHER_WAGE = 35% |
LevelTwo |
Constants | L~25 | TEACHER_WAGE_L2 = 40% |
Impact
Invariant violation — contradicts protocol spec:
“Payment structure is as follows: 35% teachers + 5% principal = 40% total; 60% must remain post-upgrade”
Potential overpayment risk to teachers/principal on upgrade (45% total instead of 40%)
Tools Used
Slither
Recommendations
Explicitly enforce LevelOne teacher wage (35%) during graduateAndUpgrade()
→ Do not apply LevelTwo wage until post-upgrade sessions
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.