Submission Details
Severity:
There is no check for `sessionEnd` before an upgrade is done which allows the System to upgrade before school's `sessionEnd` has reached
**Description:** One of the invariants states `System upgrade cannot take place unless school's `sessionEnd` has reached`. However this check is not made on the `LevelOne::graduateAndUpgrade`
**Impact:** This allows the System to upgrade before school's `sessionEnd` has reached
**Proof of Concept:**
1. Add teachers
2. Enroll students
3. Start session
4. Upgrade and graduate without checking session has ended
<details>
<summary> Proof of Code </summary>
Add the following in the `LevelOneAndGraduateTest.t.sol` which fails since the time `graduateAndUpgrade` is called does not match `sessionEnd`
```js
function test_cant_upgrade_before_sessionEnd() public schoolInSession {
uint256 sessionEnd = levelOneProxy.getSessionEnd();
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
assertEq(sessionEnd, block.timestamp);
}
```
</details>
**Tools Used** Manual Review and Foundry
**Recommended Mitigation:** Add a check on the `graduateAndUpgrade` function to ensure that the sessionEnd has reached before upgrading the system
Updates
Lead Judging Commences
yeahchibyke 7 months ago
Submission Judgement Published Assigned finding tags:
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.