Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[H-4] Function `LevelOne::graduateAndUpgrade` doesn't check if the session has ended, breaking 2 of the protocol's invariants

sa1nt

Description: In function graduateAndUpgrade there are no checks if the session has ended yet, and if the sessionEnd variable has been reached. This means that the protocol can be upgraded even if the time passed since session started is less than 4 weeks, breaking 2 invariants of the protocol that are presented in the documentation.

A school session lasts 4 weeks.
System upgrade cannot take place unless school's sessionEnd has reached.

Impact: Two of the invariants of the protocol are being broken because of this root cause.

Proof of Concept: In this test function there is no revert in the graduateAndUpgrade even if no time has passed since starting and ending the school session.

function testCanGraduateAndUpgradeEvenIfSessionEndHasNotBeenReachedYet() public {
_teachersAdded();
_studentsEnrolled();
​
uint256 sessionStart = block.timestamp;
​
vm.prank(principal);
levelOneProxy.startSession(70);
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
uint256 sessionEnd = block.timestamp;
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data); // does not revert
​
assertEq(sessionStart, sessionEnd);
assertLt(sessionEnd, sessionStart + 4 weeks);
}

Recommended Mitigation: Verify in the graduateAndUpgrade if the sessionEnd time variable has been reached.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
+ require(block.timestamp >= sessionEnd, "School session has not ended yet");
.
.
.
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.