Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

## \[H-03] The Principal Can Continuously Call `graduateAndUpgrade`, Resulting in Exhaustion of Remaining Funds in the Contract

0x996

Summary

The principal has the ability to continuously call graduateAndUpgrade, which will cause the remaining funds in the contract to be drained, and the principal will receive all of these funds!

Vulnerability Details

Vulnerability 1:

  1. After graduateAndUpgrade is called, the bursary state variable remains unchanged and is not reduced.

Vulnerability 2:

  1. Description: https://codehawks.cyfrin.io/c/2025-05-hawk-high/s/cmab7s6be0003jv048rhptktl

Impact

Combining Vulnerability 1 and Vulnerability 2 will allow the principal to receive 100% of the total funds, draining the remaining funds in the contract after the first call!

POC

Not written.

Recommendations

  1. Add a mutex lock.

  2. This function should only be callable once per semester.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0x996 Submitter
6 months ago
yeahchibyke Lead Judge
6 months ago
yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.