Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Any Student Can graduate even if didn't match the `cutOff` Score

mosmoker

Summary

This is a logic bug where there is a leak for checking the cutOff Score that is essential to determine the students who will be graduate (if meets the cutOff Score), or won't be (if didn't meet the cutOff Score), causing all the students to graduate even if some of them didn't match the cutOff Score.

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file

2- add the following PoC code to the test file:

function testAllStudentsCanGraduateWithNoRestriction() public {
vm.warp(block.timestamp + 1 weeks);
_teachersAdded();
_studentsEnrolled();
​
vm.prank(principal);
levelOneProxy.startSession(100); // the cutOffScore is 100
console2.log("cutOff Score is : ", levelOneProxy.cutOffScore());
​
vm.startPrank(alice);
levelOneProxy.giveReview(clara, false);
levelOneProxy.giveReview(dan, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(clara, false);
levelOneProxy.giveReview(dan, false);
vm.stopPrank();
​
console2.log("Clara's score --> : ", levelOneProxy.studentScore(clara));
console2.log("Dan's score --> : ", levelOneProxy.studentScore(dan));
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, "");
​
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
​
console2.log(levelTwoProxy.getTotalStudents());
assertEq(levelTwoProxy.isStudent(clara), true);
assertEq(levelTwoProxy.isStudent(dan), true);
}

3- In the command line, run the following command: forge test --match-test testAllStudentsCanGraduateWithNoRestriction -vvv

4- You'll see the following output :

cutOff Score is : 100
Clara's score --> : 80
Dan's score --> : 80
6
​
Suite result: ok. 1 passed; 0 failed; 0 skipped

Impact

Any student can graduate even if didn't match the cutOff Score.

Tools Used

  • manual Recon.

  • foundry test suite

Recommendations

Add the following restriction to the LevelOne::graduateAndUpgrade function :

if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
+ uint256 studentLength = listOfStudents.length;
+ for (uint256 i = 0; i < studentLength; i++){
+ if (listOfStudents[i] < cutOffScore){
+ listOfStudents[i] = listOfStudents[studentLength - 1];
+ listOfStudents.pop();
+ isStudent[listOfStudents[i]] = false;
+ break;
+ }
+ }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.