Hawk High

Summary

The system allows a contract upgrade (via graduateAndUpgrade) even if students have not received all 4 reviews (one for each week of a session). This contradicts expected behavior and can lead to incomplete assessments and unfair bursary allocations.

Vulnerability Details

Each student is expected to receive 4 weekly reviews during the session. However, there is:

1. No validation in graduateAndUpgrade() to check whether each student has received 4 reviews.

2. An incomplete implementation of giveReview(), where reviewCount[_student] is never incremented, making it impossible to verify the number of reviews each student has received.

This enables the principal to prematurely upgrade the system even if students haven't been fairly assessed.

Proof of Concept

1. reviewCount[_student] is never incremented in giveReview function therefore we can't track number of reviews per student

2. There is no checks in graduateAndUpgrade on studentReviews amount

Impact

• Invariant mentioned in the DOCS will break

  Students must have gotten all reviews before system upgrade. System upgrade should not occur if any student has not gotten 4 reviews (one for each week)

Recommendation

1. Increment reviewCount[_student] inside giveReview

2. Add check mechanims on students reviews count in graduateAndUpgrade