Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The graduateAndUpgrade() function does not check if each student has received 4 reviews before upgrading. This breaks the contract logic and may allow unqualified students to graduate

harisuthan5534798

Description

The principal can call the graduateAndUpgrade() function to upgrade the system and graduate students. However, it does not check whether each student has received exactly 4 reviews — one for each week of the school session. According to the contract's design and invariants, all students must be reviewed 4 times before being considered for graduation

Impact

1) Students may graduate without receiving all required reviews

Proof of code

The graduateAndUpgrade() function does not contain a loop to check if all students have received the required 4 reviews. As a result, the contract can proceed with the upgrade even if some students have not met the review requirement. This breaks the logic of the system and could lead to students graduating without fulfilling the conditions

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

Tools Used

1) Vs code

2) Manual review

Recommendations

To ensure that all students meet the review condition before graduation, a loop should be added to check each student's review count. Only if all students have received 4 reviews should the system proceed with the upgrade.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
--------->>for(uint256 n = 0; n < listOfStudents.length; n++) {
​
if(reviewCount[listOfStudents[n]] < 4) {
revert HH__NotAllowed();
}
​
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
​




Updates

Lead Judging Commences

yeahchibyke Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

yeahchibyke Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.