Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect teacher wage calculation leads to excessive payments

anchabadze

Description:

The graduateAndUpgrade() function in the LevelOne contract incorrectly calculates the payment amount for each teacher. The function calculates payPerTeacher as 35% of the total bursary, but then pays this full amount to each teacher instead of dividing it among all teachers.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ...
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION; // 35% of bursary
// ...
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher); // Each teacher gets 35% of bursary
}
// ...
}

According to the documentation, teachers should share 35% of all school fees as their wages, not each receive 35%. This means that if there are two teachers, they will collectively receive more than the intended 35% of the bursary. If there are more than two, the entire transaction will revert due to insufficient balance, no one will receive payment, and the contract upgrade will fail

Impact:

1) If there are two teachers they will receive more then expected

2) If there are more than two teachers (more likely) than the whole tx will revert:

  • no one will receive payment

  • upgrade will fail

Recommended Mitigation:

Modify the wage calculation to divide the total teacher allocation among all teachers

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.