Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Session End Validation in Upgrade Function

0x_martonyx

Summary

The graduateAndUpgrade() function lacks validation to ensure upgrades only occur after the session has officially ended (block.timestamp >= sessionEnd). This allows Premature upgrades before all students complete their 4-week review cycles.

Vulnerability Details

  • Checks only for zero-address and authorization.

  • No temporal validation of sessionEnd.

  • Distribute payments and upgrade without waiting 4 weeks.

  • Students graduate with incomplete reviews (only 1 week of evaluations).

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// Missing sessionEnd check
_authorizeUpgrade(_levelTwo);
// Proceeds with payments/upgrade
}

POC

function test_confirm_can_graduate_before_session_ends() public schoolInSession {
levelTwoImplementation = new LevelTwo();
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
vm.warp(block.timestamp + 1 weeks);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(address(levelTwoImplementation), data);
// Check that only eligible students graduated
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
assertEq(levelTwoProxy.getTotalStudents(), 6);
}

Impact

System can be upgraded prematurely before session completion, breaking protocol rules.

Tools Used

foundry Tests

Recommendations

Add time validation before proceding with the function

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (block.timestamp < sessionEnd) {
revert HH__SessionNotEnded();
}
// ... rest of logic ...
}

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.