summary

Missing invariants when upgrading or graduating

vulnerability details

The LevelOne::graduateAndUpgrade function was missing the below invariants
Principal can trigger this function irrespective of any of the below invairants

-> Students must have gotten all reviews before system upgrade. System upgrade should not occur if any student has not gotten 4 reviews (one for each week)
-> Any student who doesn't meet the cutOffScore should not be upgraded
-> System upgrade cannot take place unless school's sessionEnd has reached

impact - High

likelyhood - High

Recommendations

Need to implement all the above invairants specified

(will provide a POC if vulnerability details is not understandable)