Hawk High

Summary

The LevelOne contract contains a potential issue in the wage distribution logic, specifically with the calculation of the teachers' wages. The contract assumes a fixed percentage allocation, but due to the way the wages are calculated, teachers might not receive the correct wage distribution.

Vulnerability Details

In the graduateAndUpgrade() function, the wages for teachers are calculated using the formula:

The TEACHER_WAGE constant is defined as 35% (35/100), but the actual distribution may not be accurate because:

1. Bursary Allocation: The bursary is divided by a fixed constant (PRECISION = 100), which may not fully account for rounding errors or edge cases, leading to an incorrect allocation.

2. Variable Number of Teachers: If there are a large number of teachers, the individual payment might be too small to be practically meaningful or lead to rounding errors.

3. Teacher Wage Allocation: Given the 35% split for teachers and the contract's static constants, if the total funds are not properly accounted for (due to rounding errors), some teachers may receive less than their fair share, especially if the contract is handling fractional USDC amounts.

Impact

1. Incorrect Teacher Payments: The teachers might receive an incorrect wage. This discrepancy can lead to a lack of trust and dissatisfaction, especially if some teachers receive significantly less than expected.

2. Contract Integrity: This flaw might cause issues in the contract's balance or distribution logic. Teachers may not be paid the intended 35% share of the bursary.

3. Inconsistent Financial Reporting: The wage distribution logic may result in inaccurate financial records, making audits and financial reconciliations more difficult.

4. Economic Discrepancies: Teachers may not receive adequate compensation for their role in the educational system, which could potentially undermine the credibility and functioning of the contract as a whole.

Tools Used

• Solidity analysis

• Manual inspection

• Slither (optional, for static analysis)

• Manual test cases to simulate potential flaws

Recommendations

1. Ensure Precise Division: One solution is to introduce a larger precision constant (e.g., PRECISION = 10000) to minimize rounding errors and ensure that each teacher’s payment is calculated with greater accuracy.

   uint256 payPerTeacher = (bursary * TEACHER_WAGE) / (PRECISION * 100); // Adjust precision factor

2. Check for Zero Payments: Implement checks to ensure that teachers are paid at least a minimal amount. This avoids the case where teachers might receive a zero or negligible payment due to rounding.

   if (payPerTeacher == 0) {

   revert HH__TeacherPaymentTooLow();

   }

3. Handle Fractional USDC Payments: Ensure that fractional amounts of USDC are appropriately handled (if the token supports decimals). If the token uses a standard 6 decimal places, the rounding error should be adjusted accordingly.

4. Distribute Evenly Among Teachers: Instead of the fixed percentage calculation, consider distributing the wages evenly across all teachers after accounting for other deductions or financial conditions in the contract.

   uint256 totalWagePool = bursary * TEACHER_WAGE / PRECISION;

   uint256 payPerTeacher = totalWagePool / listOfTeachers.length;

5. Provide Detailed Reverts: Ensure that detailed error messages are provided when issues occur in the payment process, such as when the contract cannot pay a teacher properly.

   error HH__TeacherPaymentTooLow();

By implementing these changes, the contract will ensure that teachers receive the correct compensation based on the bursary and the predefined wage percentage. This will address any potential discrepancies or errors caused by the current wage split logic.