Hawk High

Description:

The removeTeacher(address _teacher) function in LevelOne.sol contract iterates over the dynamic array listOfTeachers using a for-loop to find and remove a specific teacher. This loop has no upper bound, and as the number of teachers grows, the gas required to execute the loop increases linearly. If the array becomes sufficiently large, the function may exceed the block gas limit, rendering it uncallable even by the principal. This could permanently prevent the removal of teachers from the contract.

Impact:

An attacker or unintended behavior could cause the listOfTeachers array to grow indefinitely. This would lead to the removeTeacher() function failing due to out-of-gas errors, resulting in a Denial of Service. The principal would be unable to manage the teacher list effectively, impacting contract governance and functionality.

Tools used:

Manual reviews

Remediation:

Replace the unbounded loop with a constant-time removal pattern using a mapping to track each teacher's index in the array. This allows efficient lookup and removal without iteration. Example mitigation:

This approach ensures constant gas cost regardless of the array size and eliminates the DoS vector.