Summary

The principal can add himself as a teacher by calling 'addTeacher`

Vulnerability Details

Contrary to `enroll`, the function does not revert if the argument _teacheris the principal address.

Impact

The princiapl will receive a part of the fees distributed to teacher in graduateAndUpgrade

The impact is low because even if the function revert, the principal can still bypass the check by providing another address managed by him.

Tools Used

Manual analysis

Recommendations

Add the same check as for enroll

if (msg.sender == principal) {
revert HH__NotAllowed();
}