Hawk High

First Flight #39

Beginner FriendlySolidity

100 EXP

View results

Previous Next

Submission Details

Severity: high

Valid

Students who do not meet the cutoff mark still gets graduated to the second contract

dexcripter

Summary

The graduateAndUpgrade function in LevelOne.sol fails to enforce the protocol invariant that only students meeting or exceeding the cutOffScore—and who have received all four weekly reviews—are promoted to the next level. As a result, underperforming students can still be upgraded and counted as graduates, violating the intended access control and academic integrity of the system.

Vulnerability Details

Missing Score Check: There is no iteration over listOfStudents to verify that each student’s studentScore is at or above cutOffScore.
Missing Review Count Check: The contract does not track or enforce that each student has received exactly four reviews before allowing the upgrade. In fact, the reviewCount mapping is never incremented in giveReview, so even if checks were added, they would always fail to detect missing reviews.
Unconditional Upgrade: After calling _authorizeUpgrade, the function immediately transfers wages to teachers and principal without conditionally excluding failing students or preventing the upgrade if any student is below cutoff or lacks reviews.
Test POC: The provided Foundry test demonstrates that Harriet—whose score was reduced below the cutoff of 70 via four consecutive bad reviews—remains enrolled after graduateAndUpgrade and is counted among the students in the new LevelTwo implementation.

function test_can_student_with_poor_performance_graduate() public schoolInSession {

vm.warp(block.timestamp + 1 weeks);

vm.prank(alice);

levelOneProxy.giveReview(harriet, false);

vm.warp(block.timestamp + 1 weeks);

vm.prank(alice);

levelOneProxy.giveReview(harriet, false);

vm.warp(block.timestamp + 1 weeks);

vm.prank(alice);

levelOneProxy.giveReview(harriet, false);

vm.warp(block.timestamp + 1 weeks);

vm.prank(alice);

levelOneProxy.giveReview(harriet, false);

levelTwoImplementation = new LevelTwo();

levelTwoImplementationAddress = address(levelTwoImplementation);

bytes memory data = abi.encodeCall(LevelTwo.graduate, ());

vm.prank(principal);

levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);

LevelTwo levelTwoProxy = LevelTwo(proxyAddress);

assert(levelOneProxy.getTotalStudents() == 6);

assert(levelTwoProxy.getTotalStudents() == 6);

console2.log(levelOneProxy.getTotalStudents()); // 6

console2.log(levelTwoProxy.getTotalStudents()); // 6 @> harriet was still upgraded

}

modifier schoolInSession() {

_teachersAdded();

_studentsEnrolled();

vm.prank(principal);

levelOneProxy.startSession(70);

}

function _teachersAdded() internal {

vm.startPrank(principal);

levelOneProxy.addTeacher(alice);

levelOneProxy.addTeacher(bob);

vm.stopPrank();

}

function _studentsEnrolled() internal {

vm.startPrank(clara);