Hawk High

The graduateAndUpgrade() function loops over listOfTeachers and calls:

If a teacher is a malicious contract, it could re-enter graduateAndUpgrade() (or another sensitive function) before the loop completes, potentially manipulating intermediate state.

Impact

• The risk is currently limited because:

• USDC.transfer (ERC-20) does not execute recipient code.

• onlyTeacher and non-zero bursary checks further reduce the attack surface.

• However, if a future upgrade enables ERC-777 tokens, hooks, or callbacks, the contract would become vulnerable.

Recommended Mitigation:

• Add OpenZeppelin’s nonReentrant modifier to graduateAndUpgrade() and any function that sends funds.

• Follow the “checks-effects-interactions” pattern by moving state changes before external transfers.