Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Review count not incremented due to a lack of updating the `reviewCount` mapping.

gkarumbi

Summary

A lack of update in the reviewCount mapping leads to review count not being incremented.

Vulnerability Details

A reviewCount mapping keeps tracks of how many review have been give and should be updated in the LevelOne.sol::giveReview function, however it is not.

Impact

It renders the following check require(reviewCount[_student] < 5, "Student review count exceeded!!!"); useless as reviewCount[_student] will always be zero

POC:

function test_review_count_not_incremented() public schoolInSession {
// Get initial timestamp after school session starts
uint256 initialTime = block.timestamp;
// Log initial review count
console2.log("Initial review count for student:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for first review
vm.warp(initialTime + 1 weeks + 1 hours);
// Give first review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 90 after first bad review, assuming we start from 100
assertEq(levelOneProxy.studentScore(harriet), 90, "Score should be 90 after first review");
console2.log("Review count after 1st review:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for second review
vm.warp(block.timestamp + 1 weeks + 1 hours);
// Give second review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 80 after second bad review
assertEq(levelOneProxy.studentScore(harriet), 80, "Score should be 80 after second review");
console2.log("Review count after 2nd review:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for third review
vm.warp(block.timestamp + 1 weeks + 1 hours);
// Give third review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 70 after third bad review
assertEq(levelOneProxy.studentScore(harriet), 70, "Score should be 70 after third review");
console2.log("Review count after 3rd review:", levelOneProxy.getReviewCount(harriet));
// If review count is still 0 or less than 3 after three reviews, we have a vulnerability
if (levelOneProxy.getReviewCount(harriet) < 3) {
console2.log("VULNERABILITY CONFIRMED: reviewCount is not being incremented");
console2.log("Expected review count: 3, Actual review count:", levelOneProxy.getReviewCount(harriet));
} else {
console2.log("No vulnerability - reviewCount was properly incremented to", levelOneProxy.getReviewCount(harriet));
}
}

Also add the following getter on LevelOne.sol

function getReviewCount(address _student) public view returns (uint256) {
return reviewCount[_student];
}

Tools Used

Manual Review Foundry

Recommendations

Increase review count like this reviewCount[_student]++; after giving the student a review, I will give the proper formatting in the report for another vuln within the same function

Updates

Lead Judging Commences

yeahchibyke Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!