We can update even if the session hasn't reached `sessionEnd`
Summary
There are no checks if we reached sessionEnd or not.
Vulnerability Details
The invariant says:
System upgrade cannot take place unless the school's
sessionEndhas reached
However, in LevelOne::graduateAndUpgrade, we don't check if we reached the sessionEnd or not.
Impact
The system can upgrade before the sessionEnd was reached, which breaks the invariant quoted above. However, since this call needs to be done by the principal, I assume they're trusted, so it's Low severity.
Tools Used
Manual Review
Recommendations
Add a check inside LevelOne::graduateAndUpgrade if block.timestamp >= sessionEnd.
Lead Judging Commences
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.