Hawk High

Summary

The addTeacher function currently allows the principal to add an unlimited number of teachers before a session starts. There is no constraint on the number of teachers that can be added, regardless of:

• The total number of students enrolled

• The available budget or payment pool for teachers

This design flaw can result in unintended dilution of teacher compensation, especially in scenarios where the number of teachers exceeds what the budget or student-to-teacher ratio can reasonably support.

Vulnerability Details

Steps to Reproduce:

1. Deploy the contract.

2. Enroll a limited number of students (e.g. 10).

3. Add an excessively large number of teachers (e.g. 50).

4. Observe that all are accepted, even though there's likely insufficient budget for fair compensation.

Impact
Reduced or zero compensation per teacher

Tools Used
manual review

Recommendations

Implement validation in addTeacher to ensure:

• The number of teachers does not exceed a configurable teacher-to-student ratio.

• The projected total payout to teachers does not exceed the total allocated budget.