Hawk High

First Flight #39

Beginner FriendlySolidity

100 EXP

View results

Previous Next

Submission Details

Severity: low

Valid

Ineffective review limit (Root Cause: reviewCount never increments

proofofexploit

The logic intends to restrict to 5 reviews per student using require(reviewCount[_student] < 5, "Student review count exceeded!!!");. However, the contract never executes reviewCount[_student] += 1 after granting a review. Result: the counter remains at zero and the check never triggers, even after dozens of evaluations.

Impact:

Teachers can issue unlimited reviews each week, reducing a student’s score to arbitrarily low values.
Risk of functional DoS: review spam increases gas usage and clogs functions that iterate over review histories.
Academic integrity compromised: the advertised limit (5) is never enforced.

Proof of Concept:

function test_unlimitedReviews() public {

_teachersAdded();

_studentsEnrolled();

vm.prank(principal);

levelOneProxy.startSession(70); // arranca la sesión

vm.warp(block.timestamp + 1 weeks); // semana 1

vm.startPrank(alice);

for (uint256 i; i < 6; ++i) { // 6 reseñas negativas

levelOneProxy.giveReview(clara, false);

vm.warp(block.timestamp + 1 weeks); // salta a la semana siguiente

}

vm.stopPrank();

// score original = 100, cada reseña resta 10 ⇒ 100 - 60 = 40

assertEq(levelOneProxy.studentScore(clara), 40);

}

output

❯ forge test --mt test_unlimitedReviews -vvvvv

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. Visit https://book.getfoundry.sh/announcements for more information.

To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

[⠊] Compiling...

No files changed, compilation skipped

Ran 1 test for test/LeveOnelAndGraduateTest.t.sol:LevelOneAndGraduateTest

[PASS] test_unlimitedReviews() (gas: 870403)

Traces:

[8721671] LevelOneAndGraduateTest::setUp()

├─ [4431614] → new DeployLevelOne@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f

│ ├─ [0] VM::addr(<pk>) [staticcall]

│ │ └─ ← [Return] principal: [0x6b9470599cb23a06988C6332ABE964d6608A50ca]

│ ├─ [0] VM::label(principal: [0x6b9470599cb23a06988C6332ABE964d6608A50ca], "principal")

│ │ └─ ← [Return]

│ └─ ← [Return] 21885 bytes of code

├─ [3732450] DeployLevelOne::deployLevelOne()

│ ├─ [793117] → new MockUSDC@0x104fBc016F4bb334D775a19E8A6510109AC63E00

│ │ └─ ← [Return] 3734 bytes of code

│ ├─ [0] VM::startBroadcast()

│ │ └─ ← [Return]

│ ├─ [2608546] → new LevelOne@0x34A1D3fff3958843C43aD80F30b94c510645C316

│ │ └─ ← [Return] 13028 bytes of code

│ ├─ [67213] → new ERC1967Proxy@0x90193C961A926261B756D1E5bb255e67ff9498A1

│ │ ├─ emit Upgraded(implementation: LevelOne: [0x34A1D3fff3958843C43aD80F30b94c510645C316])

│ │ └─ ← [Return] 212 bytes of code

│ ├─ [93107] ERC1967Proxy::fallback(principal: [0x6b9470599cb23a06988C6332ABE964d6608A50ca], 5000000000000000000000 [5e21], MockUSDC: [0x104fBc016F4bb334D775a19E8A6510109AC63E00])

│ │ ├─ [92624] LevelOne::initialize(principal: [0x6b9470599cb23a06988C6332ABE964d6608A50ca], 5000000000000000000000 [5e21], MockUSDC: [0x104fBc016F4bb334D775a19E8A6510109AC63E00]) [delegatecall]

│ │ │ ├─ emit Initialized(version: 1)

│ │ │ └─ ← [Stop]

│ │ └─ ← [Return]

│ ├─ [0] VM::stopBroadcast()

│ │ └─ ← [Return]

│ └─ ← [Return] ERC1967Proxy: [0x90193C961A926261B756D1E5bb255e67ff9498A1]

├─ [712] DeployLevelOne::getUSDC() [staticcall]

│ └─ ← [Return] MockUSDC: [0x104fBc016F4bb334D775a19E8A6510109AC63E00]

├─ [603] DeployLevelOne::principal() [staticcall]

│ └─ ← [Return] principal: [0x6b9470599cb23a06988C6332ABE964d6608A50ca]

├─ [521] DeployLevelOne::getSchoolFees() [staticcall]

│ └─ ← [Return] 5000000000000000000000 [5e21]

├─ [516] DeployLevelOne::getImplementationAddress() [staticcall]

│ └─ ← [Return] LevelOne: [0x34A1D3fff3958843C43aD80F30b94c510645C316]