Hawk High

Summary

The LevelOne contract for Hawk High School contains a critical design flaw that allows the principal to also be assigned as a teacher. This creates a conflict of interest in the governance structure and enables financial exploitation through dual compensation at the time of fund distribution.

Detailed Analysis

Technical Details

The vulnerability exists in the addTeacher() function of the LevelOne contract:

The function fails to check whether the address being added as a teacher is the same as the principal's address. While there are checks to prevent zero addresses, existing teachers, and students from being added as teachers, there is no check to prevent the principal from being added as a teacher.

Fund Distribution Analysis

During graduation and contract upgrade, the graduateAndUpgrade() function distributes funds as follows:

With constants defined as:

If the principal is also a teacher, they would receive:

1. Principal payment: 5% of the bursary

2. Teacher payment: A portion of the 35% allocated to teachers (35% / number of teachers)

Exploitation Scenario

Consider a scenario with a bursary of 1000 USDC:

• With 5 teachers (including the principal):

  • Each teacher gets (1000 * 35/100) / 5 = 70 USDC

  • Principal gets 1000 * 5/100 = 50 USDC

  • Principal's total: 70 + 50 = 120 USDC (12% of bursary instead of intended 5%)

• With just 2 teachers (principal and one other):

  • Each teacher gets (1000 * 35/100) / 2 = 175 USDC

  • Principal gets 1000 * 5/100 = 50 USDC

  • Principal's total: 175 + 50 = 225 USDC (22.5% of bursary)

Business Logic Implications

The dual role creates several governance issues:

1. Incentive Misalignment: The principal is incentivized to minimize the number of teachers to maximize their teacher's share

2. Power Imbalance: As both administrator and educator, the principal can influence student reviews from multiple angles

3. Financial Inequity: The dual compensation unfairly distributes school resources

Code Fix Recommendation

Add a check to prevent the principal from being added as a teacher:

Alternative Mitigation

If the business logic specifically allows for a principal to also be a teacher, consider:

1. Implementing a separate wage calculation that prevents double-dipping

2. Creating transparency mechanisms to make this dual role visible

3. Adding governance controls that require approval from multiple parties for certain actions when roles are combined

Conclusion

The lack of a check preventing the principal from becoming a teacher represents a significant flaw in the contract's role separation design. It not only creates economic imbalances but also undermines the intended governance structure of the Hawk High School system. This issue should be addressed prior to deploying this contract to production.