Hawk High

Summary

Lack of reentrancy protection in graduateAndUpgrade risks state manipulation or fund loss.

Vulnerability Details

The graduateAndUpgrade function in LevelOne.sol uses usdc.safeTransfer to send funds to Teachers and the Principal without a reentrancy guard. A malicious contract as a Teacher could re-enter the function during transfer, potentially manipulating state or draining funds if logic is added later.

Impact

Could lead to financial loss or unintended state changes.

Tools Used

Manual code review and reentrancy analysis.

Recommendations

Import ReentrancyGuardUpgradeable and add nonReentrant modifier to graduateAndUpgrade, initializing it in initialize.