Hawk High

Vulnerability Details

1. The graduateAndUpgrade function has no time restrictions, such as requiring the term to end before funds can be allocated.

2. This could allow the principal to exploit two out of the three methods described in H-01, H-03, and H-04 to obtain all student fees and execute a rug pull.

Impact

The project is overly centralized, which poses the risk of centralization hazards. The principal may take advantage of the huge financial incentives and run off with the funds prematurely.

POC

Not written.

Recommendations

I haven’t come up with a solution yet—everything is possible when faced with human nature. There’s no solution!