Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Payment Calculation in `graduateAndUpgrade` Function in `Session1.sol`

bambooboo

Summary

The graduateAndUpgrade function contains a critical miscalculation in determining teacher payments, resulting in significant overpayment to each teacher. If there are multiple teachers, this bug can drain the contract’s entire bursary balance.

Vulnerability Details

The function is defined as follows:

Source Link (Line 295)

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

The variable payPerTeacher is intended to allocate a portion of the total bursary to all teachers. However, the current implementation allocates that portion per teacher, resulting in an over-distribution.

This leads to:

  • Overpayment to teachers

  • Bursary depletion

  • Inaccurate wage distribution

Impact

  • High financial risk: The contract could drain funds if totalTeachers > 2

  • Violation of intended logic: Teachers receive more than their fair share

  • Breaks trust assumptions: Wage allocation logic does not match declared constants

Tools Used

  • Manual Code Review

Recommendations

Correct the calculation to distribute the teacher wage pool equally among all teachers:

uint256 totalTeachers = listOfTeachers.length;
require(totalTeachers > 0, "No teachers to pay");
​
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 payPerTeacher = totalTeacherPay / totalTeachers;

This ensures the teacher wage pool is correctly distributed among all teachers, preserving contract integrity and preventing fund loss.

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.