Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First review can be given immediately due to uninitialized timestamp

anchabadze

Description:

In the giveReview() function, there is a check to ensure that reviews can only be given once per week:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}

However, when a student first enrolls, their lastReviewTime[_student] value is initialized to the default value of 0. This means that the condition block.timestamp >= lastReviewTime[_student] + reviewTime will always be true for the first review, regardless of when it's given.

Impact:

Teachers can give the first review to a student immediately after enrollment, due to another vulnerability where there is no strict requirement that reviews can only be given after the session has started.
Depending on the time between the student's enrollment and the official start of the session, the student may receive as many additional reviews as the number of weeks that pass between enrollment and the session's end.

If combined with the missing review counter increment, this could allow multiple reviews to be given in quick succession

This vulnerability undermines the time-based constraints of the review system and could lead to unfair evaluation of students.

Recommended Mitigation:

Initialize the lastReviewTime = block.timestamp for all students in startSession() function

Combined with restriction to prevent teachers to review students before session started.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.