Hawk High

Vulnerability Details

1. The startSession function contains the notYetInSession modifier restriction.

2. There is no inSession = false operation performed throughout the entire project.

3. This causes the principal to only be able to start the first term, and subsequent terms cannot be started.

Impact

The principal can only start one term and cannot initiate a second or third term!

POC

Not written.

Recommendations

When executing the graduateAndUpgrade function, the inSession = false operation should be performed. This would signify the end of the term after fund allocation, allowing the principal to start a second term!