Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Unrestricted review distribution in giveReview() __LevelOne.sol

hawks

Summary

The giveReview function allows the teachers to give a review to students once per week. However, reviews are conducted manually, and the teachers manually selects which students to review.

Vulnerability Details

The current setup in the giveReview function is vulnerable to human error or favoritism because the review distribution is manual and unrestricted. Without any fairness enforcement, some students may never receive reviews, which can block their graduation.

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
reviewCount[_student] += 1;
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
​

Scenario: Imbalanced Reviewing

Assume there are 10 enrolled students. The teachers, either unintentionally or bias, consistently reviews only 2 of them.

Week-by-Week Example:

Week Reviewed Students Notes
1 Alice Only Alice gets reviewed
2 Alice, Bob Bob gets 1st, Alice 2nd
3 Alice, Bob Alice: 3rd review, Bob: 2nd
4 Alice, Bob Alice: 4th review, Bob: 3rd

Result:

  • Alice can graduate (received 4 reviews).

  • Bob might graduate.

  • Other 8 students have zero reviews effectively blocked.


Impact

Students may get stuck and unable to graduate due to lack of reviews

This can compromise the integrity and fairness of the review system

Tools Used

Manual review

Recommendations

Implement fairness in review distribution. For example:

Enforce one review per student per week.


Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!