Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Bursary Reset Allows Repeated Fund Distribution in graduateAndUpgrade

tanmaygupta0215

Summary

In the graduateAndUpgrade function, the bursary pool is distributed to teachers and the principal based on predefined percentages. However, the bursary variable is never reset to zero after this distribution. This omission allows the function to be called multiple times, redistributing the same funds repeatedly, resulting in double payments and a critical financial vulnerability.

Vulnerability Details

Problematic Code:

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
// Distribute funds (no cleanup)
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
​
// Missing: bursary = 0;
​

Example Exploit:

  1. Bursary has 1000 USDC.

  2. Principal calls graduateAndUpgrade, distributing funds.

  3. Since bursary is not reset, calling the function again will distribute another 1000 USDC.

  4. This continues until the contract’s balance is drained.

Impact

  • Severe Financial Loss: Contract funds can be emptied unfairly.

  • Abuse of Authority: The principal could maliciously or mistakenly exploit this to repeatedly extract funds.

  • Broken Upgrade Semantics: Misuse of graduateAndUpgrade not only upgrades but continues payout cycles.

Tools Used

  • Manual review

  • Solidity state variable behavior

  • Contract flow analysis

Recommendations

Reset the bursary pool to zero after funds have been distributed:

Fixed Code:

usdc.safeTransfer(principal, principalPay);
​
// Reset bursary to prevent re-use
bursary = 0;

Additional Safeguards:

  • Add a graduated flag to prevent re-entry or multiple calls.

  • Add event logging for auditing bursary values before and after distribution.

  • Include test coverage for double-call scenarios in test suites.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

bursary not updated

The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

bursary not updated

The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.