Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing reviewCount Incrementation in LevelOne::giveReview

ddeenny

Summary

The LevelOne::giveReview function allows teachers to review students once per week, up to a maximum of 5 reviews per student. However, the function never increments the reviewCount variable, meaning the condition reviewCount[_student] < 5 is always true. As a result, teachers can indefinitely lower a student’s score, bypassing intended review limits.

Vulnerability Details

// @audit-issue reviewCount is never incremented, so the limit check is ineffective
function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
// @> reviewCount[_student] is never incremented
}

Issue Explanation

The function intends to limit reviews to five per student, but fails to enforce it due to missing state update:

  1. Bypass Review Cap
    Teachers can continuously give negative reviews every week since reviewCount[_student] is never updated.

  2. Unbounded Score Reduction
    A malicious teacher could reduce a student’s score to zero or below over time, preventing graduation or other benefits.

  3. Misleading Access Control
    The presence of a cap (< 5) gives the illusion of protection, but is effectively non-functional.

Impact

  • Academic Manipulation: Teachers can unfairly target students, causing failure or disqualification.

  • Broken Business Logic: Graduation criteria based on studentScore can be easily sabotaged.

Tools Used

  • Manual Code Review

Recommendations

Increment reviewCount[_student] after a successful review to properly enforce the 5-review limit:

function giveReview(address _student, bool review) public onlyTeacher {
...
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
reviewCount[_student] += 1; // @fix increment to enforce review cap
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.