Summary

The addTeacher() function fails to prevent the principal from adding themselves as a teacher, allowing them to:

1. Illegitimately claim a share of the teachers' 35% bursary allocation

2. Still receive their normal 5% principal payment

Vulnerability Details

Location

• File: levelOne.sol

• Functions:

  • addTeacher()

  • graduateAndUpgrade()

    function addTeacher(address _teacher) public onlyPrincipal notYetInSession {

    if (_teacher == address(0)) {

    revert HH__ZeroAddress();

    }

    ​

    if (isTeacher[_teacher]) {

    revert HH__TeacherExists();

    }

    ​

    if (isStudent[_teacher]) {

    revert HH__NotAllowed();

    }

    ​

    listOfTeachers.push(_teacher);

    isTeacher[_teacher] = true;

    ​

    emit TeacherAdded(_teacher);

    }

    ​

    ​

    ​

    function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {

    if (_levelTwo == address(0)) {

    revert HH__ZeroAddress();

    }

    uint256 totalTeachers = listOfTeachers.length;

    ​

    @> uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

    @> uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;

    ​

    _authorizeUpgrade(_levelTwo);

    ​

    for (uint256 n = 0; n < totalTeachers; n++) {

    usdc.safeTransfer(listOfTeachers[n], payPerTeacher);

    }

    ​

    usdc.safeTransfer(principal, principalPay);

    }

Issue

The access control has two critical flaws:

1. No check preventing principal == _teacher

2. Principal receives both:

   • Normal 5% principal payment

   • Illegitimate teacher payment (shared from 35% pool)

Proof of Concept

Test Case:

Test Result:

Impact

• Direct fund theft from the teacher pool

• Violates documented payment structure (5% principal + 35% teachers)

• Creates governance trust issues

Tools Used

• Foundry (forge test)

• Manual analysis of payment flows

Recommendations

• Add principal exclusion check in addTeacher():