Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

A teacher can call LevelOne::giveReview function more than 5 times disrupting function design

0xtory

Summary

A teacher could exploit the LevelOne::giveReview by giving a student review more than 5 times because LevelOne::reviewCount mapping for a student is not incremented after each review, this bypasses the require check and disrupts function's intention

Vulnerability Details

The require statement would fail to revert when student reviews has exceeded the limit which is 5 because reviewCount is not been incremented after each review in the function

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
@> require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}

Impact

A worst case scenario involves a Malicious Teacher calling LevelOne::giveReview countless times, giving a student reviews for as long as the student has a score, the teacher could go as far as giving bad reviews until the students score is reduced to zero.

Tools Used

Foundry Testing and Manual Review

Recommendations

Increment ``LevelOne::reviewCount mapping for each student after each review

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
+ reviewCount[_student] += 1;
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.