Submission Details
Severity:
[EVMN-HH05] Bursary Accounting Issue After Upgrade
Summary
Bursary Accounting Issue After Upgrade
Vulnerability Details
According to the invariants, 60% of the bursary should remain after upgrade. However, there is no mechanism to ensure this happens. The contract distributes 35% to teachers and 5% to the principal but doesn't update the bursary value or transfer the remaining funds to the new implementation.
Impact
High (High Impact, High Likelihood)
Tools Used
Manual review
Recommendations
Add code to properly handle the remaining bursary funds:
function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
if (block.timestamp < sessionEnd) {
revert("Session has not ended yet");
}
// Check that all students have received 4 reviews
for (uint256 i = 0; i < listOfStudents.length; i++) {
if (reviewCount[listOfStudents[i]] != 4) {
revert("Not all students have received 4 reviews");
}
}
// Remove students who don't meet the cutoff score
for (uint256 i = 0; i < listOfStudents.length; i++) {
if (studentScore[listOfStudents[i]] < cutOffScore) {
// Swap with last element and remove
listOfStudents[i] = listOfStudents[listOfStudents.length - 1];
listOfStudents.pop();
i--; // Adjust index after removal
}
}
uint256 totalTeachers = listOfTeachers.length;
// Calculate payments
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
// Calculate remaining bursary (60%)
uint256 remainingBursary = bursary - totalTeacherPay - principalPay;
// Update bursary for the upgrade
bursary = remainingBursary;
// Only proceed with payments if there are teachers
if (totalTeachers > 0) {
uint256 payPerTeacher = totalTeacherPay / totalTeachers;
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
}
usdc.safeTransfer(principal, principalPay);
// Call the upgrade with the remaining data
_authorizeUpgrade(_levelTwo);
emit Graduated(_levelTwo);
}
Updates
Lead Judging Commences
yeahchibyke 6 months ago
Submission Judgement Published Assigned finding tags:
bursary not updated
The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.