Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

graduateAndUpgrade lacks time check

mustaphaabdulaziz00

Summary

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L295

The graduateAndUpgrade function in the LevelOne smart contract is responsible for upgrading the contract and distributing the bursary to the principal and teachers. However, it lacks a critical time check to ensure the function is only called after the school session has ended. This missing condition violates the intended session flow logic and could lead to premature contract upgrades and fund distribution.

Vulnerability Details

The function graduateAndUpgrade(address _levelTwo, bytes memory) does not include a check for block.timestamp >= sessionEnd, which is necessary to ensure the academic session has concluded before graduation and contract upgrade can occur.

Relevant code snippet:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
​

Impact

Without the time constraint, the principal can arbitrarily call this function at any point, including immediately after starting a session.

Tools Used

Recommendations

Updates

Lead Judging Commences

yeahchibyke Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.