Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Review Count Update in giveReview

elyas6126

Summary

The giveReview function does not increment the reviewCount for students when a review is given. As a result, the review count remains unchanged regardless of how many reviews a student receives, which can disrupt logic that relies on tracking the number of reviews per student.

Vulnerability Details

The giveReview function is intended to limit the number of reviews a student can receive by checking that reviewCount[_student] < 5. However, the function does not increment reviewCount[_student] after a review is given. As a result, the review count for each student remains at its default value (zero), allowing unlimited reviews to be submitted for a student, and breaking any logic that depends on the review count.

** PoC

function test_review_count_remains_unchanged() public {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
vm.stopPrank();
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
vm.startPrank(dan);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
vm.startPrank(eli);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
vm.prank(principal);
levelOneProxy.startSession(70);
vm.stopPrank();
​
vm.warp(block.timestamp + 1 weeks);
​
vm.startPrank(alice);
levelOneProxy.giveReview(eli, false);
vm.stopPrank();
​
assert(levelOneProxy.getReviewCount(eli) == 0);
}

Impact

  1. The intended restriction on the maximum number of reviews per student is not enforced.

  2. Students can receive more reviews than allowed, potentially leading to unfair or unintended changes in their scores.

  3. Any contract logic or business rules that rely on the review count will not function as expected.

Tools Used

Manual review, Foundry

Recommendations

Increment reviewCount[_student] each time a review is given in the giveReview function to properly enforce the review limit and maintain accurate tracking.

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
+ reviewCount[_student]++;
​
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.