Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

[H-03] Principal Can Rug Teachers by Removing Them After Session Ends But Before Payment Distribution

0xshaedyw

Summary

The removeTeacher() function allows the principal to maliciously remove teachers between session end and payment distribution in graduateAndUpgrade(), effectively blocking legitimate teachers from receiving their 35% bursary share.

Vulnerability Details

Location

  • File: levelOne.sol

  • Functions:

    • removeTeacher()

    • graduateAndUpgrade()

Issue

  • Unprotected Removal Window: Teachers can be removed after session ends but before payments are processed

Proof of Concept

Test Case:

function test_principal_rugs_teacher_by_removal_before_payment() public {
// 1. Setup: Add teacher and start session
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.startSession(70);
// 2. Verify teacher exists
assertEq(levelOneProxy.getTotalTeachers(), 1);
// 3. Fast-forward to session end
vm.warp(block.timestamp + 4 weeks);
// 4. Malicious removal before payment
levelOneProxy.removeTeacher(alice);
vm.stopPrank();
// 5. Verify theft
assertFalse(levelOneProxy.isTeacher(alice));
assertEq(levelOneProxy.getTotalTeachers(), 0);
}

Test Result:

Ran 1 test for test/LevelOneAndGraduateTest.t.sol:LevelOneAndGraduateTest
[PASS] test_principal_rugs_teacher_by_removal_before_payment() (gas: 119379)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.50ms (321.16µs CPU time)

Impact

High Severity because:

  • Destroys trust in the educational DAO model

  • Violates implied payment guarantees to teachers

Tools Used

  • Foundry (forge test)

  • Manual analysis of state transitions

Recommendation

1) Add Removal Time Lock:

function removeTeacher(address _teacher) public onlyPrincipal {
require(block.timestamp < sessionEnd, "Cannot remove after session");
// ... existing logic ...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge
27 days ago
yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Design choice
yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.