Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

[H-5] Missing Access Control on graduate() Function at `LevelTwo.sol` contract

aliyugombe

Description:

The graduate() function is marked public and lacks any access control. Without a modifier like onlyPrincipal, any external address can invoke this function. Since it is also upgradeable (via reinitializer(2)), future versions could introduce sensitive logic, making the lack of access control a critical risk.

Impact:

Any user could potentially trigger graduation logic meant only for the principal, leading to unauthorized state transitions or misuse once the function is fully implemented.

Tools Used

Manual reviews

Recommendations

Restrict access to the graduate() function by adding a proper access control modifier, such as:

function graduate() public onlyPrincipal reinitializer(2) { ... }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.