Submission Details
Severity:
[M-1] Missing check for end of the session can lead to countinue give a reviews of the students
Summary
In LevelOne::giveReview the protocol does NOT check if the session expired. If the session ended, no more reviews should be given to the students, which can influence the students degree.
Impact
Reviews can be given after the session is over.
Tools Used
Manual Review
Proof Of Code: Add this test and run it.
function test_confirm_can_give_review_after_session_expired() public schoolInSession {
// giving only 3 revuews and skip one week
uint256 startTimestamp = block.timestamp;
for (uint i = 0; i < 3; i++) {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, true);
}
//simulating 5 weeks of school which is bigger than sessiton time (4 weeks), but we can give one more review
vm.warp(block.timestamp + 2 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
console2.log('startTimestamp', startTimestamp);
console2.log('currentTimestamp', block.timestamp);
assertLt(startTimestamp + 4 weeks, block.timestamp);
assertEq(levelOneProxy.studentScore(harriet), 90);
}
Recommendations
Add check for the time and session end
function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
+ if(block.timestamp >= sessionEnd) {
+ revert HH__NotAllowed();
+ }
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
// Update last review time
lastReviewTime[_student] = block.timestamp;
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates
Lead Judging Commences
yeahchibyke 6 months ago
Submission Judgement Published Assigned finding tags:
session state not updated
`inSession` not updated after during upgrade
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.