Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

[L-5] Missing Validation for cutOffScore Parameter

nymuelis

Severity

Low

Impact

The startSession function allows the principal to set any value for the cutOffScore parameter without validation, potentially leading to impossible graduation requirements or allowing all students to pass regardless of performance.

Description

The startSession function sets the cutOffScore parameter without any bounds checking:

function startSession(uint256 _cutOffScore) public onlyPrincipal notYetInSession {
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore;
​
emit SchoolInSession(block.timestamp, sessionEnd);
}

There are no validation checks to ensure that _cutOffScore is within a reasonable range (e.g., between 0 and 100). This means:

  1. The principal could accidentally or maliciously set cutOffScore to an impossibly high value (e.g., 1000), making it impossible for any student to graduate

  2. The principal could set cutOffScore to 0, allowing all students to graduate regardless of their performance

  3. There's no protection against input errors when calling this critical function

Since the cutOffScore directly affects whether students can graduate after the session ends, this validation gap could severely impact the proper functioning of the educational system.

Tools Used

Manual code review

Recommended Mitigation

Add parameter validation to ensure cutOffScore is within a reasonable range:

function startSession(uint256 _cutOffScore) public onlyPrincipal notYetInSession {
// Ensure cutOffScore is within reasonable bounds (e.g., 0-100)
require(_cutOffScore > 0 && _cutOffScore <= 100, "Invalid cutOffScore: must be between 1 and 100");
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore;
​
emit SchoolInSession(block.timestamp, sessionEnd);
}

This ensures that graduation requirements are neither impossible nor trivial to meet.

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.