Submission Details
Severity:
Flawed Teacher Payment Distribution
Summary
A critical vulnerability has been identified in the LevelOne smart contract, The payment calculation pays each teacher the entire teacher allocation (35% of the bursary) instead of dividing it among all teachers.
Vulnerability Details
In the graduateAndUpgrade function, the teacher payment calculation incorrectly gives each teacher the full percentage of the bursary:
// Incorrect calculation in LevelOne
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
Each teacher receives (bursary * 35) / 100, which is 35% of the total bursary. With multiple teachers, this will multiply the amount paid out.
Below is the test case that demonstrates this vulnerability:
POC (PROOF OF CONCEPT)
Below is the test file for the vulnerability:
// SPDX-License-Identifier: SEE LICENSE IN LICENSE
import {Test, console2} from "forge-std/Test.sol";
import {DeployLevelOne} from "../script/DeployLevelOne.s.sol";
import {GraduateToLevelTwo} from "../script/GraduateToLevelTwo.s.sol";
import {LevelOne} from "../src/LevelOne.sol";
import {LevelTwo} from "../src/LevelTwo.sol";
import {MockUSDC} from "./mocks/MockUSDC.sol";
contract LevelOneAndGraduateTest is Test {
DeployLevelOne deployBot;
GraduateToLevelTwo graduateBot;
LevelOne levelOneProxy;
LevelTwo levelTwoImplementation;
address proxyAddress;
address levelOneImplementationAddress;
address levelTwoImplementationAddress;
MockUSDC usdc;
address principal;
uint256 schoolFees;
// teachers
address alice;
address bob;
address bhatia;
// students
address clara;
address dan;
address eli;
address fin;
address grey;
address harriet;
function setUp() public {
deployBot = new DeployLevelOne();
proxyAddress = deployBot.deployLevelOne();
levelOneProxy = LevelOne(proxyAddress);
// graduateBot = new GraduateToLevelTwo();
usdc = deployBot.getUSDC();
principal = deployBot.principal();
schoolFees = deployBot.getSchoolFees();
levelOneImplementationAddress = deployBot.getImplementationAddress();
alice = makeAddr("first_teacher");
bob = makeAddr("second_teacher");
bhatia = makeAddr("third_teacher");
clara = makeAddr("first_student");
dan = makeAddr("second_student");
eli = makeAddr("third_student");
fin = makeAddr("fourth_student");
grey = makeAddr("fifth_student");
harriet = makeAddr("six_student");
usdc.mint(clara, schoolFees);
usdc.mint(dan, schoolFees);
usdc.mint(eli, schoolFees);
usdc.mint(fin, schoolFees);
usdc.mint(grey, schoolFees);
usdc.mint(harriet, schoolFees);
}
function test_confirm_first_deployment_is_level_one() public view {
uint256 expectedTeacherWage = 35;
uint256 expectedPrincipalWage = 5;
uint256 expectedPrecision = 100;
assertEq(levelOneProxy.TEACHER_WAGE(), expectedTeacherWage);
assertEq(levelOneProxy.PRINCIPAL_WAGE(), expectedPrincipalWage);
assertEq(levelOneProxy.PRECISION(), expectedPrecision);
assertEq(levelOneProxy.getPrincipal(), principal);
assertEq(levelOneProxy.getSchoolFeesCost(), deployBot.schoolFees());
assertEq(levelOneProxy.getSchoolFeesToken(), address(usdc));
}
function test_confirm_add_teacher() public {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
vm.stopPrank();
assert(levelOneProxy.isTeacher(alice) == true);
assert(levelOneProxy.isTeacher(bob) == true);
assert(levelOneProxy.getTotalTeachers() == 2);
}
function test_confirm_cannot_add_teacher_if_not_principal() public {
vm.expectRevert(LevelOne.HH__NotPrincipal.selector);
levelOneProxy.addTeacher(alice);
}
function test_confirm_cannot_add_teacher_twice() public {
vm.prank(principal);
levelOneProxy.addTeacher(alice);
vm.prank(principal);
vm.expectRevert(LevelOne.HH__TeacherExists.selector);
levelOneProxy.addTeacher(alice);
}
function test_confirm_remove_teacher() public {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
vm.stopPrank();
vm.prank(principal);
levelOneProxy.removeTeacher(alice);
assert(levelOneProxy.isTeacher(alice) == false);
assert(levelOneProxy.getTotalTeachers() == 1);
}
function test_confirm_enroll() public {
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
assert(usdc.balanceOf(address(levelOneProxy)) == schoolFees);
}
function test_confirm_cannot_enroll_without_school_fees() public {
address newStudent = makeAddr("no_school_fees");
vm.prank(newStudent);
vm.expectRevert();
levelOneProxy.enroll();
}
function test_confirm_cannot_enroll_twice() public {
vm.startPrank(eli);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.prank(eli);
vm.expectRevert(LevelOne.HH__StudentExists.selector);
levelOneProxy.enroll();
}
modifier schoolInSession() {
_teachersAdded();
_studentsEnrolled();
vm.prank(principal);
levelOneProxy.startSession(70);
_;
}
function test_confirm_can_give_review() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assert(levelOneProxy.studentScore(harriet) == 90);
}
function test_confirm_can_graduate() public schoolInSession {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
console2.log(levelTwoProxy.bursary());
console2.log(levelTwoProxy.getTotalStudents());
}
function testTeacherPaymentError() public schoolInSession {
uint256 sessionEnd = levelOneProxy.sessionEnd();
vm.warp(sessionEnd + 1);
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
uint256 teacher1BalanceBefore = usdc.balanceOf(alice);
uint256 teacher2BalanceBefore = usdc.balanceOf(bob);
uint256 teacher3BalanceBefore = usdc.balanceOf(bhatia);
uint256 principalBalanceBefore = usdc.balanceOf(principal);
vm.startPrank(principal);
vm.expectRevert();
levelOneProxy.graduateAndUpgrade(address(levelTwoProxy), bytes(""));
uint256 bursary = usdc.balanceOf(address(levelOneProxy));
uint256 teacherWage = 35; // 35%
uint256 principalWage = 5; // 5%
uint256 precision = 100;
uint256 expectedTeacherPay = (bursary * teacherWage) / precision; // Each teacher gets 35%
uint256 expectedPrincipalPay = (bursary * principalWage) / precision; // Principal gets 5%
uint256 totalPayment = (expectedTeacherPay * 3) + expectedPrincipalPay;
// With 3 teachers at 35% each + 5% for principal = 110% of funds
// This would cause a revert due to insufficient balance
console2.log("Expected payment per teacher:", expectedTeacherPay);
console2.log("Total teacher payments:", expectedTeacherPay * 3);
console2.log("Principal payment:", expectedPrincipalPay);
console2.log("Total payments:", totalPayment);
console2.log("Available bursary:", bursary);
}
// ////////////////////////////////
// ///// /////
// ///// HELPER FUNCTIONS /////
// ///// /////
// ////////////////////////////////
function _teachersAdded() internal {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
levelOneProxy.addTeacher(bhatia);
vm.stopPrank();
}
function _studentsEnrolled() internal {
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(dan);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(eli);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(fin);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(grey);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(harriet);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
}
}
After running forge test --mt testTeacherPaymentError -vvv:
Expected payment per teacher: 10500000000000000000000
Total teacher payments: 31500000000000000000000
Principal payment: 1500000000000000000000
Total payments: 33000000000000000000000
Available bursary: 30000000000000000000000
The Total payment > Available bursarywhich means the function will revert due to insufficient balance.
Impact
With more than one teacher, the contract will pay out more than intended
With 3+ teachers, the contract will attempt to pay more than 100% of the bursary (35% × N + 5% principal)
Will eventually lead to failed transfers and locked funds when bursary is insufficient
Financial loss for the protocol
Tools Used
Manual code review, arithmetic validation
Recommendations
Correct the payment calculation to divide the teacher allocation among all teachers:
uint256 totalTeachers = listOfTeachers.length;
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
if (totalTeachers > 0) {
uint256 payPerTeacher = totalTeacherPay / totalTeachers;
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
}
usdc.safeTransfer(principal, principalPay);
Updates
Lead Judging Commences
yeahchibyke 7 months ago
Submission Judgement Published Assigned finding tags:
incorrect teacher pay calculation
`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.