Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Students can graduate when LevelOne::graduateAndUpgrade is called despite not meeting cutoff mark , this clearly breaks one of the protocol invariants

0xtory

Summary

During a school session a teacher could give either good or bad reviews to students, after school session ends, the principal ends up graduating all students regardless of student not meeting the cutoff mark. This clearly breaks protocol invariant and gives the school protocol bad look.

Vulnerability Details

The function LevelOne::graduateAndUpgrade clearly do not include any plan to screen students scores before graduating them to levelTwo

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

Impact

The school could loose credibility and sets a bad standard as a result of graduating students who do not meet the cutoff mark

Tools Used

Manual Review

Recommendations

There are several mitigations measures the protocol can take, one of them includes looping through listOfStudents array and checking cutoff mark for each students, thereby removing student addresses who do not meet up with the cutoff mark requirements

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
+ uint256 studentLength = listOfStudents.length;
+ for (uint256 n = 0; n < studentLength; n++) {
+ address student = listOfStudents[n];
+ if (studentScore[student] < cutOffScore) {
+ listOfStudents[n] = listOfStudents[studentLength - 1];
+ listOfStudents.pop();
+ isStudent[student] = false;
+ studentScore[student] = 0;
+ }
}
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.