Hawk High

Vulnerability Details

1. The removeTeacher function lacks the notYetInSession modifier protection, allowing the principal to remove all teachers during the semester.

2. As described in H-01 report, the principal can add themselves as a teacher.

3. Therefore, after the principal calls graduateAndUpgrade, they will receive a 35%+5% fund allocation. As described in H-03 report, by repeatedly calling this function, the principal will ultimately obtain the entire fund allocation from the fund pool.

Impact

By combining several vulnerabilities, this is the third method through which the principal can obtain the entire fund allocation!

POC

Not written.

Recommendations

Add the notYetInSession modifier and fix the vulnerabilities in H-01 and H-03.