Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `Principal` can upgrade the system even if not all students have gotten a complete `4 reviews`

mosmoker

Summary

this bug breaks the protocl rules where the principal can easily upgrade the system even if not all the students have gotten their complete four reviews before the upgrade and the graduation.

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file

2- Add the following PoC code to the test file:

function testStudentsCanGraduateEvenIfNotGotFourReviews() public {
_teachersAdded();
_studentsEnrolled();
vm.prank(principal);
levelOneProxy.startSession(70);
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, "");
​
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
​
console2.log(levelTwoProxy.getTotalStudents());
assertEq(levelTwoProxy.isStudent(clara), true);
assertEq(levelTwoProxy.isStudent(dan), true);
}

3- In the command line, run the following command: forge test --match-test testStudentsCanGraduateEvenIfNotGotFourReviews -vvv

4- the output would be as following :

6
​
Suite result: ok. 1 passed; 0 failed; 0 skipped

Impact

this bug completely breaks the protocol rules and implementations where the rules say Students must have gotten all reviews before system upgrade. System upgrade should not occur if any student has not gotten 4 reviews (one for each week) but using the test PoC Code showing a complete break/bypass for this rule. Allowing the Principal to upgrade the system and claims the rewards even if not all the students have gotten their all reviews (4 reviews).

Tools Used

  • Manual Recon

  • foundry test suite

Recommendations

Add the following implementation in the LevelOne::giveReview function :

lastReviewTime[_student] = block.timestamp;
​
+ reviewCount[_student] += 1;

and also add the following restriction to the LevelOne::graduateAndUpgrade function :

if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
+ uint256 studentLength = listOfStudents.length;
+ for (uint256 i = 0; i < studentLength; i++){
+ if (reviewCount[listOfStudents[i]] < 4){
+ revert();
+ }
+ }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.