Hawk High

[H-1] Unprotected upgradeable contract, attacker can take control of uninitalized contract and upgrade it to some other malicious code

Description: An Attack can call the LevelOne::initialize function before it is initalized by the deployer, and become the principal, potentally exploiting every principle privileges like addTeacher expel startSession graduateAndUpgrade , even upgrading the contract to a malacious code.

Reference to the function:
https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L120

Impact: The attacker can take full control of ALL the admin privilages. The system is compromised, funds may be stolen, and legitimate users (students, teachers, principal) are locked out or expelled, If the attacker destroys the logic contract (via a malicious upgrade), the proxy becomes unusable, causing a DoS

Proof of Concept:

Given below is the attacker contact through which one can exploit the LevelOne.sol contract.

Recommended Mitigation: Call the _disableInitializers function on a constructor

• _disableInitializers marks a contract as permanently initialized, preventing any initializer functions (like initialize) from being called on it.

• It’s used in the constructor of a logic contract to ensure that the contract cannot be initialized directly, reserving initialization for the proxy.