Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No verification to ensure students have reached the cutOffScore before graduating

vincent71399

Description: According to the documentation, students must reach the cutOffScore before they can graduate.
However, there is no check for this in the graduateAndUpgrade function.

Impact: It breaks the contract's logic, since all students will be upgraded even if they have not reached the cutOffScore.

Proof of Concept: add following test and run

modifier studentEnrolled() {
vm.startPrank(student_1);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_2);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(student_3);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
_;
}
modifier addTeachers() {
vm.startPrank(principal);
levelOneProxy.addTeacher(teacher_1);
levelOneProxy.addTeacher(teacher_2);
vm.stopPrank();
_;
}
modifier startSession() {
vm.startPrank(principal);
levelOneProxy.startSession(cutOffScore);
vm.stopPrank();
_;
}
...
function test_no_check_for_cutScore() public studentEnrolled addTeachers startSession {
// cutOffScore is 70
assertEq(cutOffScore, 70);
vm.startPrank(teacher_1);
vm.warp(block.timestamp + 1 weeks);
for(uint256 i = 0; i < 4; i++) {
levelOneProxy.giveReview(student_1, false);
vm.warp(block.timestamp + 1 weeks);
}
vm.stopPrank();
assertEq(levelOneProxy.studentScore(student_1), 60);
vm.startPrank(principal);
LevelTwoEdit levelTwo = new LevelTwoEdit();
levelOneProxy.graduateAndUpgrade(address(levelTwo), abi.encodeWithSignature("graduate()"));
LevelTwoEdit levelTwoProxy = LevelTwoEdit(address(levelOneProxy));
assertTrue(levelTwoProxy.isStudent(student_1)); // student_1 can still graduate even if score is below cutOffScore
vm.stopPrank();
}

Recommended Mitigation: Add a check to ensure that all students have reached the cutOffScore before allowing the upgrade, otherwise expel them

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
...
+ uint256 totalStudents = listOfStudents.length;
+ for(uint256 n = 0; n < totalStudents; n++) {
+ address _student = listOfStudents[n];
+ if (studentScore[_student] < cutOffScore) {
+ expel(_student);
+ }
}
...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.