Submission Details
Impact:
Likelihood:
Lack of checks could lead to an arithmetic underflow
Summary
In the LevelOne.sol: giveReview function, there is not check to ensure that the studentScore never goes below zero
Vulnerability Details
We have see that the function giveReview only gives reviews one way - negative review, since reviewCount is never updated and the line below is always true, it is possible for our review to go into the negative causing an underflow
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
Impact
The arithmetic underflow causes our protocol to break
Tools Used
Manual Review/ Foundry
POC:
function test_potential_score_underflow_impact() public schoolInSession {
// Get initial timestamp after school session starts
uint256 initialTime = block.timestamp;
console2.log("Initial student score:", levelOneProxy.studentScore(harriet));
// Give 11 negative reviews (starting score is 100, each review decreases by 10)
// This would theoretically bring the score to -10 if underflow were possible
for (uint i = 0; i < 11; i++) {
// Fast forward time to allow for next review
vm.warp(initialTime + (i+1) * (1 weeks + 1 hours));
// Give a negative review
vm.prank(alice);
try levelOneProxy.giveReview(harriet, false) {
uint256 currentScore = levelOneProxy.studentScore(harriet);
console2.log("After review #", i+1, "score:", currentScore);
// Check if we've hit zero
if (currentScore == 0) {
console2.log("Score has reached zero after review #", i+1);
}
} catch Error(string memory reason) {
//Overflow causes error in the 11th iteration
console2.log("Review #", i+1, "failed with reason:", reason);
break;
}
}
}
## Recommendations
Add a check to ensure _studentScore is always a non-zero numbers
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.