Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Review count not incremented due to a lack of updating the `reviewCount` mapping.

gkarumbi

Summary

A lack of update in the reviewCount mapping leads to review count not being incremented.

Vulnerability Details

A reviewCount mapping keeps tracks of how many review have been give and should be updated in the LevelOne.sol::giveReview function, however it is not.

Impact

It renders the following check require(reviewCount[_student] < 5, "Student review count exceeded!!!"); useless as reviewCount[_student] will always be zero

POC:

function test_review_count_not_incremented() public schoolInSession {
// Get initial timestamp after school session starts
uint256 initialTime = block.timestamp;
// Log initial review count
console2.log("Initial review count for student:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for first review
vm.warp(initialTime + 1 weeks + 1 hours);
// Give first review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 90 after first bad review, assuming we start from 100
assertEq(levelOneProxy.studentScore(harriet), 90, "Score should be 90 after first review");
console2.log("Review count after 1st review:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for second review
vm.warp(block.timestamp + 1 weeks + 1 hours);
// Give second review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 80 after second bad review
assertEq(levelOneProxy.studentScore(harriet), 80, "Score should be 80 after second review");
console2.log("Review count after 2nd review:", levelOneProxy.getReviewCount(harriet));
// Fast forward time to allow for third review
vm.warp(block.timestamp + 1 weeks + 1 hours);
// Give third review
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
// Student score should be 70 after third bad review
assertEq(levelOneProxy.studentScore(harriet), 70, "Score should be 70 after third review");
console2.log("Review count after 3rd review:", levelOneProxy.getReviewCount(harriet));
// If review count is still 0 or less than 3 after three reviews, we have a vulnerability
if (levelOneProxy.getReviewCount(harriet) < 3) {
console2.log("VULNERABILITY CONFIRMED: reviewCount is not being incremented");
console2.log("Expected review count: 3, Actual review count:", levelOneProxy.getReviewCount(harriet));
} else {
console2.log("No vulnerability - reviewCount was properly incremented to", levelOneProxy.getReviewCount(harriet));
}
}

Also add the following getter on LevelOne.sol

function getReviewCount(address _student) public view returns (uint256) {
return reviewCount[_student];
}

Tools Used

Manual Review Foundry

Recommendations

Increase review count like this reviewCount[_student]++; after giving the student a review, I will give the proper formatting in the report for another vuln within the same function

Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!