Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Medium: Upgrade can be executed while students have fewer than 4 weekly reviews

andir16

Description

The specification states:

“Students must have gotten all reviews before system upgrade. System upgrade should not occur if any student has not gotten 4 reviews (one for each week).”

LevelOne::graduateAndUpgrade never inspects the reviewCount mapping. As a result, the principal can upgrade the proxy even if every student has zero reviews.

Impact

  • Violates a core academic‑performance invariant; un‑evaluated students advance.

  • Subsequent logic that assumes reviewCount == 4 (e.g. scholarship gates, score averaging, expulsion) runs on invalid state.

  • While no funds are stolen immediately, contract behaviour diverges from the published business rules, which can later translate into economic loss or mis‑distribution of rewards.

Severity: Medium (state‑integrity breach without direct fund loss).

Proof of Concept

Add the test to LevelOneAndGraduateTest.t.sol and run: forge test --match-test test_graduateWithZeroReviews -vvv The test will pass, proving that students graduate without the required four reviews.

function test_graduateWithZeroReviews() public schoolInSession {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
assertTrue(levelOneProxy.getReviewCount(address(fin)) == 0);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
}

For testing add the following getter to LevelOne.sol (needed as reviewCount is private):

function getReviewCount(address _student) external view returns (uint256) {
return reviewCount[_student];
}

Recommended Mitigation

Add a guard that rejects the upgrade unless every student has exactly four reviews:

+modifier allStudentsReviewed() {
+ for (uint256 i; i < listOfStudents.length; ++i) {
+ require(
+ reviewCount[listOfStudents[i]] == 4,
+ "each student needs four weekly reviews"
+ );
+ }
+ _;
+}
​
​
function graduateAndUpgrade(address _levelTwo, bytes memory)
public
onlyPrincipal
+ allStudentsReviewed
{
...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.