Hawk High

Summary:** **There wasn't an updated state for the bursary before the transfer.

Vulnerability Details: The graduateAndUpdatefunction is vulnerable to reentrancy attack because it didnt update the state of the bursary before the external call safeTransfer was made.

Impact : Proof of Concept

Suppoing USDC implements a callback in the safeTransfer, an attacker could make one of the listOfTeachers address be a contract that reenters the graduateAndUpdatefunction. This could lead to multiple payouts before the function completes, potentially draining funds.

```solidity
contract MaliciousTeacher {
address public vulnerableContract;

Tools Used

Recommendations

The best way to be fully proctected agains reentrancy attacks is to update the state of the bursary and follow the CEI (Checks - Effects - Interactions) pattern for making transfers or sending tokens. Another available option of protection is to use the Open Zepplin's reentrancyguard to safe guard the whole contract from any form of reentrancy attacks.