Hawk High

Description:

The expel(address _student) function inside LevelOne.sol contract iterates over the dynamic listOfStudents array to find and remove a specified student. This linear search scales with the size of the array and has no limit, resulting in increased gas consumption as more students are added. Once the array is sufficiently large, the loop can consume all available gas, causing the transaction to revert. This can render the expel() function unusable and block the principal from managing the student list.

Impact:

A malicious user or unintended contract usage could cause listOfStudents to grow excessively. As a result, expel() would eventually consume more gas than the block limit allows, making it impossible to expel any student. This creates a Denial of Service vulnerability, harming the contract’s administration and potentially allowing students to remain in the system indefinitely against the principal's intent.

Tools used:

Manual reviews

Remediation:

Use a constant-time removal technique by tracking each student’s index with a mapping. This enables efficient removal without looping:

This pattern ensures constant gas cost and prevents the function from becoming unusable due to out-of-gas errors.