Hawk High

Summary

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelTwo.sol#L28

The LevelTwo smart contract defines a graduate() function that is publicly accessible and uses the reinitializer(2) modifier. However, the function lacks access control and internal safeguards, making it vulnerable to unauthorized execution. While the function is currently empty, its structure and naming imply that it is intended for use during a future upgrade or state transition (e.g., advancing students, distributing bursaries).

Without appropriate protection, this function may become an attack vector during future upgrades.

Vulnerability Details

Function: graduate()

Access: public

Modifier: reinitializer(2)

Issue: Anyone can call graduate() at any time, potentially triggering sensitive upgrade logic when implemented in the future.

Impact

A malicious actor could block upgrade or state transitions by front-running the graduate() call

Tools Used

Manual

Recommendations