Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[H-01] `LevelOne::giveReview` Does Not Increment `reviewCount`, Breaking Review Tracking System

0xshaedyw

Summary

The giveReview() function in levelOne.sol does not increment the reviewCount for students, making it impossible to enforce the 4-review requirement before system upgrades. This breaks core protocol functionality where students must complete all reviews before graduation.

Vulnerability Details

Location

  • File: levelOne.sol

  • Function: giveReview(address _student, bool review)

Issue

The function checks reviewCount[_student] < 5 but never increments the counter. This creates two critical problems:

  1. Teachers cannot track how many reviews a student has received

  2. The system cannot enforce the 4-review requirement before upgrades

Proof of Concept

  1. First, we added a getter function to check reviewCount:

function getReviewCount(address _student) external view returns (uint256) {
return reviewCount[_student];
}

  1. Then ran this test (after 1 week warp):

function test_reviewCount_does_not_update() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assert(levelOneProxy.studentScore(harriet) == 90);
uint256 count = levelOneProxy.getReviewCount(harriet);
assertEq(count, 0, "Review count does not increment to 1");
}

Test Result:

Ran 1 test for test/LevelOneAndGraduateTest.t.sol:LevelOneAndGraduateTest
[PASS] test_reviewCount_does_not_update() (gas: 838568)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 9.95ms (2.95ms CPU time)

Impact

  • Breaks the review tracking system entirely

  • Allows premature system upgrades (students can graduate without completing reviews)

  • Makes negative reviews (-10 score) repeatable indefinitely

Tools Used

  • Foundry (forge test)

  • Manual code review

Recommendations

Add the missing increment in giveReview():

function giveReview(address _student, bool review) public onlyTeacher {
// ... existing checks ...
reviewCount[_student]++; // Add this line
lastReviewTime[_student] = block.timestamp;
emit ReviewGiven(_student, review, studentScore[_student]);
}

Updates

Lead Judging Commences

yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.