Missing sessionEnd Check in graduateAndUpgrade
Summary
Missing sessionEnd check enables premature upgrades, violating the 4-week session invariant.
Vulnerability Details
The graduateAndUpgrade function in LevelOne.sol does not check if block.timestamp >= sessionEnd before upgrading, despite the invariant requiring a 4-week session. This allows the Principal to upgrade the system prematurely, breaking the session duration rule.
Impact
Disrupts the scheduled session timeline, affecting all actors.
Tools Used
Manual code review and Foundry testing.
Recommendations
Add require(block.timestamp >= sessionEnd, "Session has not ended"); at the start of graduateAndUpgrade.
Lead Judging Commences
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.