Summary

The enroll() function performs an external call (usdc.safeTransferFrom) before updating contract state, violating the Checks-Effects-Interactions (CEI) pattern. While USDC's trusted nature minimizes real risk, this remains a best practice violation.

Vulnerability Details

Current Implementation:

1. Checks conditions

2. Makes external call (Interaction)

3. Updates state (Effects)

Best Practice (CEI Pattern):

1. Checks conditions

2. Updates state (Effects)

3. Makes external calls (Interactions)

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L150-L155

Impact

• Theoretical Risk: Potential state inconsistencies if token were malicious

• Practical Risk: Low (USDC is non-reentrant)

Tools Used

Recommendations

Reorder operations to follow CEI pattern.