Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

A Lack of checks lead to students being eligble to be upgrade before the 4 week period.

gkarumbi

Summary

A lack of a check could make it possible for the principal to graduateAndUpgrade student before the required 4 Week Period ends.

Vulnerability Details

Part of the contract's key functionality is that students can only be upgraded after 4 weeks by the principal. However, there are no checks to ensure this, meaning upgrading of students is still possible before the lapse of the 4 weeks.

Impact

This breaks the functionality of the protocol and the principle of fairness as a malicious or compromised principle could upgrade some students before the 4-week period.

Tools Used

Manual Review / Foundry

Recommendations

Add the following checks to ensure the session has ended:

if (inSession && block.timestamp < sessionEnd) {
revert HH__SessionNotEnded();
}
​
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}

POC

function test_can_graduate_before_session_ends() public schoolInSession {
// Get the session end time
uint256 sessionEndTime = levelOneProxy.getSessionEnd();
// Verify the session is supposed to end 4 weeks from now
assertEq(sessionEndTime, block.timestamp + 4 weeks, "Session should be set to end in 4 weeks");
// Fast forward time, but not all the way to the end (only 1 week)
vm.warp(block.timestamp + 1 weeks);
// We should still be 3 weeks away from session end
assertLt(block.timestamp, sessionEndTime, "Current time should be before session end time");
// Set up for graduation
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
// Attempt to graduate before session ends
vm.prank(principal);
// If this call succeeds, it means there's no check preventing early graduation
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
// Verify the upgrade happened by checking we can interact with LevelTwo
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
// Log the successful early graduation
console2.log("Graduation was possible before session end time!");
console2.log("Session was supposed to end at:", sessionEndTime);
console2.log("But we graduated at:", block.timestamp);
console2.log("Time remaining (seconds):", sessionEndTime - block.timestamp);
// Additional verification that the upgrade worked
uint256 bursary = levelTwoProxy.bursary();
uint256 students = levelTwoProxy.getTotalStudents();
console2.log("LevelTwo bursary:", bursary);
console2.log("LevelTwo students:", students);
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.