Submission Details
Impact:
Likelihood:
[EVMN-HH11] Unbounded Student Scores
Summary
Vulnerability Details
The giveReview() function decreases the score without a lower bound, allowing scores to go negative. This could lead to unexpected behavior or errors.
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
Impact
Impact: Medium - Could cause unintended student penalties or system errors.
Likelihood: Low - Depends on review distribution but possible over time.
Tools Used
Manual review
Recommendations
Add a check to prevent scores from dropping below zero.
// In giveReview function
int256 newScore = studentScore[_student] - 10;
if (newScore < 0) {
newScore = 0;
}
studentScore[_student] = newScore;
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.