Summary

Due to the incorrect addition of a malicious teacher, funds get stuck in the contract during teacher fund allocation, causing a DOS attack. This results in other valid teachers not receiving their due funds.

Vulnerability Details

1. The principal may add a malicious teacher with a contract address that cannot receive fund allocations in the addTeacher function.

2. When using graduateAndUpgrade, because the malicious teacher cannot receive the funds, the funds get stuck in the contract, resulting in a DOS attack.

Impact

The DOS attack causes other valid teachers to be unable to receive their due funds!

POC

Not written.

Recommendations

Teacher accounts must have a receive or fallback function that can properly receive funds!