Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-01] The principal has the ability to receive (35% + 5%) of the total fund allocation.

0x996

Summary

  1. principal receives 5% of the bursary.

  2. teachers receive 35% of the bursary.

Due to two small vulnerabilities in the project, when combined, the principal can end up receiving 40% of the total fund allocation.

Vulnerability Details

Vulnerability 1:

  1. In the addTeacher function, due to a lack of strict restrictions, the principal can add themselves as a teacher.

  2. Specifically, listOfTeachers[0] = Principal.

Vulnerability 2:

  1. In the graduateAndUpgrade function, due to an error in the following code:

    uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
    ​
    for (uint256 n = 0; n < totalTeachers; n++) {
    usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
    }

  2. This results in the total teacher salary payPerTeacher being transferred entirely to listOfTeachers[0].

Conclusion:

So if listOfTeachers[0] = Principal, the principal will receive (35% + 5%) of the total fund allocation!

POC

Not written.

Recommendations

Fix for graduateAndUpgrade:

...
...
- uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
+ uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION / totalTeachers;
...
...

Fix for addTeacher:

- if (isStudent[_teacher]) {
+ if (isStudent[_teacher] || _teacher == principal) {
revert HH__NotAllowed();
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

principal can become teacher

Principal can add themselves as teacher and share in teacher pay upon graduation

Appeal created

0x996 Submitter
6 months ago
yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

principal can become teacher

Principal can add themselves as teacher and share in teacher pay upon graduation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.