Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

System Upgrade Allowed Before sessionEnd

bryanconquer

Summary

The graduateAndUpgrade() function currently does not validate whether the school session has ended (sessionEnd reached) before executing critical logic like paying wages and upgrading the system. This can lead to premature graduation and wage disbursement, violating intended lifecycle rules of the school.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src\LevelOne.sol#L295-L295

Impact

Principal can call graduateAndUpgrade() before the school session ends.

  • Teachers and principal can receive wages earlier than intended.

  • Potential for multiple premature upgrades if not otherwise guarded.

  • Violates business logic: upgrades and payouts should happen only after sessionEnd.

Tools Used

maual review

Recommendations

if (block.timestamp < sessionEnd) {
revert SchoolSessionOngoing();
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.