Submission Details
Severity:
`reviewCount` never gets incremented, allowing more than 5 reviews
Description: In LevelOne contract, the reviewCount mapping is used to track the number of reviews for each student and cannot exceed 5.
however, the reviewCount is never incremented in the LevelOne contract.
Impact: this could lead to a situation where a student can get reviewed more than 5 times
Proof of Concept: add following test and run
modifier studentEnrolled() {
vm.startPrank(student_1);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_2);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_3);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
_;
}
modifier addTeachers() {
vm.startPrank(principal);
levelOneProxy.addTeacher(teacher_1);
levelOneProxy.addTeacher(teacher_2);
vm.stopPrank();
_;
}
modifier startSession() {
vm.startPrank(principal);
levelOneProxy.startSession(cutOffScore);
vm.stopPrank();
_;
}
...
function test_giveMoreThan5Reviews() public studentEnrolled addTeachers startSession {
vm.startPrank(teacher_1);
vm.warp(block.timestamp + 1 weeks);
for(uint256 i = 0; i < 10; i++) {
levelOneProxy.giveReview(student_1, false);
vm.warp(block.timestamp + 1 weeks);
}
vm.stopPrank();
assertEq(levelOneProxy.studentScore(student_1), 0);
}
Recommended Mitigation: add the logic to increment the reviewCount in the giveReview function
function giveReview(address _student, bool review) public onlyTeacher {
...
+ reviewCount[_student] += 1;
if (!review) {
studentScore[_student] -= 10;
}
...
}
Updates
Lead Judging Commences
yeahchibyke 6 months ago
Submission Judgement Published Assigned finding tags:
reviewCount not updated
`reviewCount` for students is not updated after each review session
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.