Hawk High

Description:

The giveReview() function in the LevelOne contract lacks a check to verify that the school session has not ended before allowing teachers to give reviews to students. While the function checks that reviews are given at least one week apart, it does not verify that the current time before session ends

Attack path:

1. School session starts and runs for the intended 4 weeks

2. Session ends (block.timestamp > sessionEnd)

3. Principal delays calling graduateAndUpgrade()

4. Teachers can continue to give reviews indefinitely after the session has ended

5. Teachers could give additional negative reviews, potentially dropping students below the cutoff score after the session should have concluded

6. When the principal finally calls graduateAndUpgrade(), students may have unfairly reduced scores

Impact:

• Teachers can give reviews long after the session has ended, as long as the system hasn't been upgraded

• This violates the educational process where reviews should only be given during the active session (with perhaps a small grace period)

• Students could have their scores unfairly reduced after the session has concluded

Recommended Mitigation:

Add a check at the beginning of the giveReview() function to ensure the school session hasn't ended (or is within a reasonable grace period to give time to teachers to give the final review after session ends)