Hawk High

Summary

The LevelTwo smart contract tracks roles such as principal, teacher, and student using state variables (principal, isTeacher, isStudent) but does not enforce any access restrictions using these roles. This creates a significant security gap for any functions that may later depend on role-specific logic—such as modifying student scores, starting sessions, or distributing bursaries—because there are no protections preventing unauthorized users from calling them.

If left unresolved, this will lead to unrestricted access, privilege escalation, and loss of control over the intended role-based logic.

Vulnerability Details

Roles Defined:

principal: address public principal

teacher: mapping(address => bool) public isTeacher

student: mapping(address => bool) public isStudent

Issue: No functions currently enforce or check these roles for permissioned actions.

Implication: Any logic added in the future (e.g., updating scores, approving bursaries) will be insecure unless access controls are retrofitted.

Impact

Any user can interact with critical state functions, impersonating a teacher or principal.

Tools Used

Recommendations