`LevelOne::graduateAndUpgrade` doesn't check if all the students have 4 reviews
Summary
The invariants say that the upgrade shouldn't happen if not all the students received 4 reviews, but there's no check to ensure it.
Vulnerability Details
The invariant says:
System upgrade should not occur if any student has not gotten 4 reviews (one for each week)
However, in graduateAndUpgradewe do not check if any student received any review, which can lead to upgrades without any reviews.
Impact
This is low severity as it depends on the Principal to upgrade without verifying that all the students got their reviews. But the code still allows for that, and it's an invariant breakage.
Tools Used
Manual Review
Recommendations
I think the easiest way is to add a for-loop which will check if reviewCount[_student] == 4. However, we need to remember that for-loops waste gas + reviewCountis not updated anywhere.
Lead Judging Commences
cut-off criteria not applied
All students are graduated when the graduation function is called as the cut-off criteria is not applied.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.