M-02. System can be upgraded even if the session is not finished
Summary
The function to upgrade the system graduateAndUpgrade does not check if the session (sessionEnd) is terminated.
As a result, the principal can perform an upgrade even if the session is not finished
Vulnerability Details
As a result, the following specification is not respected
System upgrade cannot take place unless school's sessionEnd has reached
Impact
Tools Used
Foundry / static analysis
Recommendations
Revert in the function `graduateAndUpgrade if block.timestamp is < sessionEnd
Lead Judging Commences
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.