Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No check for students got 4 reviews when calling `graduateAndUpgrade`

vincent71399

Description: According to the documentation, Students must have gotten all reviews before system upgrade.
System upgrade should not occur if any student has not gotten 4 reviews (one for each week).
However, there is no check for this in the graduateAndUpgrade function.

Impact: It breaks the contract's logic, as the contract will upgrade even if some students have not gotten 4 reviews.

Proof of Concept: add following test and run

modifier studentEnrolled() {
vm.startPrank(student_1);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_2);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_3);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
_;
}
modifier addTeachers() {
vm.startPrank(principal);
levelOneProxy.addTeacher(teacher_1);
levelOneProxy.addTeacher(teacher_2);
vm.stopPrank();
_;
}
modifier startSession() {
vm.startPrank(principal);
levelOneProxy.startSession(cutOffScore);
vm.stopPrank();
_;
}
...
function test_no_check_for_student_reviews() public studentEnrolled addTeachers startSession {
vm.startPrank(principal);
levelOneProxy.startSession(cutOffScore);
levelOneProxy.graduateAndUpgrade(address(levelTwo), abi.encodeWithSignature("graduate()"));
vm.stopPrank();
}

Recommended Mitigation: Add a check to ensure that all students have received 4 reviews before allowing the upgrade

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
...
+ uint256 totalStudents = listOfStudents.length;
+ for(uint256 n = 0; n < totalStudents; n++) {
+ address _student = listOfStudents[n];
+ if(reviewCount[_student] < 4){
+ revert HH__NotGetFullReview();
+ }
+ }
...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.