Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Medium: LevelOne::graduateAndUpgrade — Missing `sessionEnd` check allows premature upgrade

andir16

Description

LevelOne::graduateAndUpgrade() may be called at any moment after startSession() because the function never verifies that the 4‑week session has actually finished.
The intended invariant “System upgrade cannot take place unless the school’s sessionEnd has been reached” is therefore unenforced.

Impact

  • The principal can upgrade the proxy contract and trigger all graduation side‑effects weeks early, before the 4 week session length has passed.

Severity = Medium: a single transaction from the principal is enough to violate the core time‑based restriction of the protocol. Assumption: Principal is trusted.

Proof of Concepts

Add to LevelOneAndGraduateTest.t.sol and run forge test --match-test test_graduateBefore_sessionEnd() -vvv ⇒ The test will pass, proving that the upgrade can be executed while block.timestamp < sessionEnd.

function test_graduateBefore_sessionEnd() public schoolInSession {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
assertLt(block.timestamp, levelOneProxy.getSessionEnd()); // session still running
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data); // succeeds
}

Recommended mitigation

Insert an explicit time‑lock at the very start of graduateAndUpgrade():

+require(block.timestamp >= sessionEnd, "Session still in progress");

or, if you prefer a modifier:

+modifier sessionEnded() {
+ require(block.timestamp >= sessionEnd, "Session still in progress");
+ _;
+}
​
function graduateAndUpgrade(address _levelTwo, bytes memory /*data*/)
public
onlyPrincipal
+ sessionEnded
{
...
}

This single guard enforces the 4‑week duration and restores the intended invariant.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.