Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[H-06] Review Timing Flaw Allows Premature Student Evaluations Before Session Start

0xshaedyw

Summary

The review system's time validation incorrectly permits teachers to evaluate students as early as 1 week after contract deployment, rather than enforcing reviews only during active sessions. This breaks the intended 4-week review cadence tied to session periods.

Vulnerability Details

Location

  • File: levelOne.sol

  • Function: giveReview(address _student, bool review)

Critical Issues

  1. Incorrect Time Reference:

    • Uses deployment timestamp (lastReviewTime = 0) instead of session start time

    • Allows first review 1 week after deployment rather than 1 week after session start

  2. Session Bypass:

    • Teachers can negatively impact student scores before educational content begins

    • Violates the intended "4 reviews per session" structure

  3. Score Manipulation Risk:

    • Students could enter session with already-reduced scores

    • Enables unfair academic penalties before course begins

Proof of Concept

Test Case:

function test_reviews_allowed_pre_session_breaks_cadence() public {
// Setup teacher and student
vm.prank(principal);
levelOneProxy.addTeacher(alice);
address newStudent = makeAddr("new_student");
deal(address(usdc), newStudent, 10_000e18);
vm.prank(newStudent);
usdc.approve(address(levelOneProxy), schoolFees);
vm.prank(newStudent);
levelOneProxy.enroll();
// Verify review allowed BEFORE session start
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(newStudent, false);
// Student already penalized before session
assertEq(levelOneProxy.studentScore(newStudent), 90);
}

Test Result:

Ran 1 test for test/LevelOneAndGraduateTest.t.sol:LevelOneAndGraduateTest
[PASS] test_reviews_allowed_pre_session_breaks_cadence() (gas: 474902)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 25.25ms (6.72ms CPU time)

Impact

Medium Severity because:

  • Distorts the intended 4-review-per-session structure

  • Allows academic penalties before educational delivery

  • Could lead to unfair student outcomes

Tools Used

  • Foundry (forge test)

Recommendations

  1. Enforce Session-Based Timing:

function giveReview(address _student, bool review) public onlyTeacher {
require(inSession, "Reviews only during active session");
require(
block.timestamp >= lastReviewTime[_student] + reviewTime,
"Weekly cadence required"
);
// ... existing logic ...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.