Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Each student must receive exactly 5 reviews before being eligible for upgrade.

avalance

Summary

The graduateAndUpgrade function performs a contract upgrade without verifying whether each student has received the required number of reviews (5). This violates a core invariant of the protocol, which mandates that a student must receive 5 reviews before being eligible for graduation or upgrade.

Vulnerability Details

The function graduateAndUpgrade lacks any logic to verify that students have been reviewed exactly 5 times before proceeding with the upgrade. As a result, students may be upgraded prematurely, without sufficient academic evaluation.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
// (Missing Check) Enforce invariant: every student must have exactly 5 reviews
for (uint256 i = 0; i < listOfStudents.length; i++) {
address student = listOfStudents[i];
if (reviewCount[student] != 5) {
revert("Each student must be reviewed exactly 5 times before upgrade");
}
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo); // Perform upgrade only after validation
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
​

However, the function only performs administrative tasks (e.g., paying teachers/principal and calling _authorizeUpgrade) and does not validate review counts for each student.

Impact

  • Students may be upgraded without meeting academic review standards.

  • Violates the protocol’s integrity and fairness guarantees.

  • Could lead to unqualified students receiving benefits or access in LevelTwo.


Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.