Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] Function `LevelOne::graduateAndUpgrade` calculates `payPerTeacher` wrong, causing teachers to be paid more than should be

sa1nt

Description: In function LevelOne::graduateAndUpgrade the payPerTeacher is calculated as the whole share of USDC that is supposed to be divided for every teacher, not as the actual share for each teacher. Variable payPerTeacher should be divided also by the number of teachers that are currently in the protocol so that it pays each teacher their share of the USDC and not the whole 35% each.

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

Impact: Teachers are paid more USDC than they should be, leaving the protocol with less than 60% USDC after upgrade.

Proof of Concept:

  1. Protocol is upgraded

  2. Amount of USDC expected to be left in the protocol after upgrading is less than it actually is

Put this in the LevelOneAndGraduateTest.t.sol:

function testGraduateAndUpgradePaysTeachersMore() public schoolInSession {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
uint256 actualUsdcInLevelOne = usdc.balanceOf(address(levelOneProxy));
uint256 expectedUsdcInLevelOne = levelOneProxy.getSchoolFeesCost() * levelOneProxy.getTotalStudents();
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
​
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
​
uint256 actualUsdcInLevelTwo = usdc.balanceOf(address(levelTwoProxy));
uint256 expectedUsdcInLevelTwo = actualUsdcInLevelOne * 60 / 100; // 60%
​
assertEq(actualUsdcInLevelOne, expectedUsdcInLevelOne);
assertLt(actualUsdcInLevelTwo, expectedUsdcInLevelTwo); // should revert since it should be equal
}

Recommended Mitigation: Easiest fix is to also divide the payPerTeacher variable by the number of teachers in the protocol.

uint256 totalTeachers = listOfTeachers.length;
​
- uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
+ uint256 payPerTeacher = (bursary * TEACHER_WAGE) / totalTeachers / PRECISION;
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.