Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Failure to Increment `reviewCount` in `giveReview` Function

mahdi811

Summary

The giveReview function in LevelOne.sol does not increment the reviewCount variable, allowing teachers to submit an unlimited number of reviews for a student, violating the project's invariant that each student should receive exactly 4 reviews (one per week).

Vulnerability Details

In the giveReview function, the following condition checks that a student's review count is less than 5:

require(reviewCount[_student] < 5, "Student review count exceeded!!!");

However, the function does not increment reviewCount[_student] after a review is submitted. As a result, reviewCount remains zero, bypassing the restriction and allowing teachers to submit unlimited reviews for a student. This violates the invariant that students should receive exactly 4 reviews during a 4-week session.

Impact

  • Impact: Medium
    This vulnerability indirectly impacts the protocol by allowing teachers to unfairly reduce a student's score through excessive negative reviews, potentially preventing qualified students from graduating or disrupting the fairness of the system. No direct financial loss occurs.

  • Likelihood: High
    Exploitation is straightforward; a malicious teacher can repeatedly submit reviews for a student without restriction, as the reviewCount check is ineffective.

Based on the Impact vs Likelihood matrix, a Medium Impact with High Likelihood results in a Medium severity rating.

Tools Used

  • Manual code analysis

  • Solidity IDE (for contract review)

Recommendations

To fix this vulnerability, increment reviewCount[_student] in the giveReview function. Suggested code:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
reviewCount[_student] += 1; // Add this line
​
emit ReviewGiven(_student, review, studentScore[_student]);
}

Additionally, consider updating the condition to reviewCount[_student] < 4 to align with the project's 4-review limit.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.