Summary

Teachers can modify student scores even after the session has ended, as giveReview does not check the inSession status.

Vulnerability Details

The giveReview function lacks a check for inSession, allowing teachers to alter scores post-session. This could retroactively affect graduation eligibility after the session ends.

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L277-L293

Impact

Scores can be manipulated after the session, undermining the integrity of the grading process.

Tools Used

Recommendations

Add a modifier or require statement in giveReview to ensure reviews are only allowed while inSession is true.