Submission Details
Impact:
Likelihood:
Bad contract logic has no way of increasing positive reviews and hence students cannot graduate
Summary
Good reviews have no effect as there is no way to way to increase positive reviews, this could mean that a student can only get negative reviews and never graduate
Vulnerability Details
In the LevelOne.sol:giveReview() function there is no logic to increase the student's score if they get a good review. Here is what I mean:
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
Impact
A student can only get a negative review and thus unfair to them. This could also break the protocol functionality
POC
function test_score_count_not_incremented() public schoolInSession {
// Get initial timestamp after school session starts
uint256 initialTime = block.timestamp;
//get initial score
uint256 initialScore = levelOneProxy.studentScore(harriet);
// Log initial score
console2.log("Initial review count for student:", levelOneProxy.getReviewCount(harriet));
console2.log("Initial student score:", initialScore);
// Give 6 reviews (beyond the limit of 5)
for (uint i = 0; i < 6; i++) {
// Fast forward time to allow for next review
vm.warp(initialTime + (i+1) * (1 weeks + 1 hours));
// Give a positive review
vm.prank(alice);
levelOneProxy.giveReview(harriet, true);
console2.log("After review #", i+1, ":");
console2.log(" - Review count:", levelOneProxy.getReviewCount(harriet));
//Observe no increase in score even after 6 reviews
console2.log(" - Student score:", levelOneProxy.studentScore(harriet));
}
// Verify vulnerability: If review count is less than 6 after 6 reviews, we have a vulnerability
//uint256 finalReviewCount = levelOneProxy.getReviewCount(harriet);
uint256 finalScore = levelOneProxy.studentScore(harriet);
console2.log("\nFinal score count after 6 reviews:", finalScore);
assertEq(finalScore, initialScore, "Score should not have changed after 6 positive reviews");
}
Tools Used
Manual Review/ Foundry
Recommendations
Add the following logic for both good and bad reviews:
if (review) {
studentScore[_student] += 10;
} else {
studentScore[_student] -= 10;
}
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.