Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Teacher Payment Calculation in graduateAndUpgrade Function

linxun

Summary

The graduateAndUpgrade function in the LevelOne contract incorrectly calculates and distributes payments to teachers. Instead of sharing 35% of the bursary among all teachers, the current implementation gives each teacher 35% of the total bursary, causing the transaction to revert when there are multiple teachers due to insufficient funds.

Vulnerability Details

The payment distribution logic in the graduateAndUpgrade function incorrectly calculates teacher payments:

In the LevelOne contract, the teacher payment calculation is implemented as follows:

uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

The problem here is that each teacher receives (bursary * TEACHER_WAGE) / PRECISION tokens, which means each teacher gets 35% of the bursary. If there are multiple teachers, this will distribute much more than the intended 35% total allocation for teachers.

For example, if there are 3 teachers, the function will attempt to pay out 105% (3 × 35%) of the bursary just to teachers, which is clearly incorrect and will cause the function to revert due to insufficient funds.

The correct implementation should be dividing the total teacher allocation among all teachers:

uint256 totalTeacherShare = (bursary * TEACHER_WAGE) / PRECISION;
uint256 payPerTeacher = totalTeacherShare / totalTeachers;

Impact

This issue has severe consequences for the contract functionality:

  1. The function will revert if there are more than 2 teachers due to insufficient funds (with 3 teachers, it would try to pay 105% of the bursary just to teachers)

  2. With a large number of teachers, the transaction will almost certainly fail due to insufficient funds

  3. The contract fails to meet its core invariant regarding teacher payment distribution

Tools Used

Manual code review

Recommendation

Modify the graduateAndUpgrade function to correctly calculate the payment per teacher by first calculating the total amount for all teachers and then dividing it equally. Also handle the case where there are no teachers:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
_authorizeUpgrade(_levelTwo);
​
// Calculate teacher share, only distribute if teachers exist
if (totalTeachers > 0) {
// Calculate the total amount for teachers to share (35%)
uint256 totalTeacherShare = (bursary * TEACHER_WAGE) / PRECISION;
// Divide equally among all teachers
uint256 payPerTeacher = totalTeacherShare / totalTeachers;
// Transfer funds to teachers
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
}
// Note: If no teachers exist, their allocation remains in the contract
​
// Transfer funds to principal
usdc.safeTransfer(principal, principalPay);
}

This implementation ensures that the 35% allocation for teachers is correctly shared among all teachers, with each teacher receiving an equal portion of the total teacher allocation, and also handles the case where there are no teachers by keeping their allocation in the contract.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.