Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The graduateAndUpgrade() function does not check if the session has ended before executing, which breaks the contract’s intended logic

harisuthan5534798

Description

The graduateAndUpgrade() function can be called without verifying whether the school session has ended. This violates the contract invariant, which states that "System upgrade cannot take place unless school's sessionEnd has been reached".

Impact

1) Teachers and the principal being paid wages before the session ends

2) Students graduating without completing the required 4-week session


Proof of code

There is no require() check to make sure the current time is after the session end time. Because of this, the graduateAndUpgrade() function can be called too early, which breaks the expected flow of the contract

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
​
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
​

Tools Used

1) VS Code
2) Manual review

Recommendations

Add a require() statement to ensure the current time is past the session end time before executing the graduateAndUpgrade() function

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
​
-------> require(block.timestamp >= sessionEnd, "Session has not ended yet");
​
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.