Summary

The giveReview function intends to limit students to 5 reviews but does not increment reviewCount, allowing unlimited reviews.

Vulnerability Details

The require(reviewCount[_student] < 5, ...) check always passes because reviewCount is never updated. Teachers can bypass the intended limit by waiting the reviewTime, affecting score fairness.

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L281

Impact

Unlimited negative reviews can unfairly reduce student scores below the cutOffScore, preventing graduation despite paying fees.

Tools Used

Recommendations

Increment reviewCount[_student] within giveReview after each review to enforce the 5-review limit.