Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of Session Status Check Allows Reviews Outside Active Session

elyas6126

Summary

The giveReview function does not check if a session is active, allowing teachers to submit reviews even when no session is in progress.

Vulnerability Details

The giveReview function does not verify whether a session is currently active before allowing a teacher to submit a review. As a result, teachers can give reviews at any time, including before a session has started.

** PoC

function test_giveReview_allowsFirstReviewBeforeInterval() public {
// Simulate a real-world block.timestamp (e.g., 1,700,000,000)
vm.warp(1_700_000_000);
​
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
vm.stopPrank();
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
vm.startPrank(dan);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
vm.startPrank(eli);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
// The function is called by the teacher before the session begins
vm.startPrank(alice);
levelOneProxy.giveReview(eli, false);
vm.stopPrank();
​
assert(levelOneProxy.studentScore(eli) == 90);
}

Impact

  1. Reviews can be submitted outside the intended session period, undermining the integrity of the review process.

  2. Student scores may be affected by reviews that occur when the session is not officially in progress, leading to inconsistent or unfair outcomes.

Tools Used

Manual review, Foundry

Recommendations

Add the notYetInSession modifier to the giveReview function to ensure that reviews can only be submitted during an active session. This will prevent teachers from giving reviews when no session is in progress.

- function giveReview(address _student, bool review) public onlyTeacher {
+ function giveReview(address _student, bool review) public onlyTeacher notYetInSession {
.
.
.
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.