Hawk High

Summary

The payment distribution system incorrectly allocates the full 35% teacher share to EACH teacher rather than splitting it among all teachers, resulting in massive overpayments that drain the contract balance and violate protocol specifications.

Vulnerability Details

Location

• File: levelOne.sol

• Function: graduateAndUpgrade(address _levelTwo, bytes memory)

  function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {

  if (_levelTwo == address(0)) {

  revert HH__ZeroAddress();

  }

  uint256 totalTeachers = listOfTeachers.length;

  ​

  @> uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

  uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;

  ​

  _authorizeUpgrade(_levelTwo);

  for (uint256 n = 0; n < totalTeachers; n++) {

  usdc.safeTransfer(listOfTeachers[n], payPerTeacher);

  }

  ​

  usdc.safeTransfer(principal, principalPay);

  }

Critical Issues

1. Multiplicative Overpayment:

   • Currently pays (bursary * 35%) to EACH teacher

   • With 2 teachers, pays 70% of bursary instead of 35% total

   • Scales dangerously with more teachers (3 teachers → 105% payout)

2. Documentation Violation:

   • Explicitly contradicts protocol specs requiring "teachers share of 35% of bursary" (total, not per-teacher)

3. Bursary Drain Risk:

   • Could completely deplete contract funds

   • Makes remaining 60% bursary guarantee impossible

Proof of Concept

Test Case:

Test Result:

Impact

Critical Severity because:

• Can drain entire bursary with enough teachers

• Makes financial promises mathematically impossible

• Violates core protocol economic model

• Could bankrupt the system

Tools Used

• Foundry (forge test)

Recommendations

• Calculate Correct Per-Teacher Share: