Hawk High

Summary

The system's logic for calculating teacher payments is flawed, leading to significant overpayment and breaking the intended bursary distribution invariant.

Vulnerability Details

In the graduateAndUpgrade() function, the calculation for payPerTeacher incorrectly determines the amount paid to each teacher. Instead of dividing the total amount allocated for all teachers (35% of the bursary) by the number of teachers, the current formula effectively calculates 35% of the total bursary for each teacher individually.

Impact

This vulnerability has a severe financial impact:

• Massive Overpayment: The total amount paid to teachers will be totalTeachers * 35% of bursary. If there is more than one teacher (totalTeachers > 1), this will significantly exceed the intended 35% allocation and could even exceed the total bursary amount, leading to contract insolvency or unexpected behavior if transfers fail.

• Invariant Violation: The core invariant that 35% of the bursary is allocated to all teachers is violated.

• Financial Loss: The contract's funds are drained much faster than intended, potentially impacting future operations or other planned distributions (like the 5% for the principal).

Tools Used

Recommendations

The calculation for payPerTeacher should be corrected to divide the total allocated amount for teachers by the number of teachers. This ensures that the 35% of the bursary is distributed among all teachers, not paid to each teacher individually.