Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Session End Check in Upgrade

mishoko

Summary

The graduateAndUpgrade function allows system upgrades before the session end time, violating the invariant that upgrades can only occur after the session has ended.

Vulnerability Details

The contract's invariants state that "System upgrade cannot take place unless school's sessionEnd has reached". However, the graduateAndUpgrade function does not validate the current timestamp against sessionEnd before proceeding with the upgrade.
Key code in LevelOne.sol:

function startSession(uint256 _cutOffScore) public onlyPrincipal notYetInSession {
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore;
emit SchoolInSession(block.timestamp, sessionEnd);
}
​
function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// No session end validation
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
...
}

Impact

  • System can be upgraded prematurely

  • Violates the core timing invariant of the system

  • Could lead to students graduating before the full session duration

  • May result in unfair evaluation periods

Proof of Concept

function test_graduate_before_session_end() public schoolInSession {
// Start session
// vm.prank(principal);
// levelOneProxy.startSession(70);
​
// Try to upgrade immediately, before session end
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
​
// Upgrade succeeded before session end
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
assert(levelTwoProxy.getTotalStudents() > 0);
}

Tools Used

  • Manual code review

  • Foundry for testing

Recommendations

Add timestamp validation in the graduateAndUpgrade function:

require(block.timestamp >= sessionEnd, "Session not ended");
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.