Hawk High

Summary

Certain functions in the LevelOne contract, such as giveReview(), are callable at any time—even outside active teaching sessions. This omission of the onlyInSession modifier (or an equivalent check) permits misuse or logically inconsistent actions that should only occur during a valid teaching session.

Vulnerability Details

The giveReview() function is defined as:

This function can be called at any time, regardless of whether the session has started or ended. Since reviews logically belong to an active course phase:

• Teachers might add reviews after the course ends or before it starts.

• Reviews could be given to students who are technically not in a valid session anymore (e.g., right after being expelled or after session ends).

Similar logic flaws may affect other session-bound operations like:

• graduateAndUpgrade()

• expel()

• withdrawTeacherWages() (if allowed after session ends)

Impact

• Logical Inconsistency: Reviews can be added outside the teaching timeline, misrepresenting student progress.

• Unintended Access: Functions dependent on session state can be misused or triggered when not appropriate.

• Security Risk: Allows interactions that were likely assumed to be time-bound, opening up possibilities for unexpected behavior or state manipulation.

Tools Used

• Manual source code review

• Contextual reasoning based on intended lifecycle of a teaching session

Recommendations

1. Introduce onlyInSession Modifier:
   Define a modifier like:

   modifier onlyInSession() {

   require(block.timestamp >= sessionStart && block.timestamp <= sessionEnd, "Outside of session");

   _;

   }

2. Apply to Time-Bound Functions:
   Apply onlyInSession to any function that should only execute while the session is ongoing. This includes:

   • giveReview()

   • expel()

   • Any grading or interaction with students

3. Add Tests:
   Add test cases to ensure these functions revert when called before startSession() or after the session has ended.

4. Audit All Entry Points:
   Review all public/external functions to ensure correct access control and session validation is applied as needed.