Hawk High

Summary

Although the contract sets a cutOffScore value at the beginning of each session to define the minimum score required for a student to graduate, this value is never referenced or enforced anywhere in the protocol. This oversight violates the documented invariant stating that students must meet the cut-off score to upgrade, rendering grading logic and student assessment meaningless.

Vulnerability Details

According to the contract's documented invariants:

“Any student who doesn't meet the cutOffScore should not be upgraded”

The cutOffScore is set when a session begins:

However, this variable is never used in any logic path. This renders cutOffScore inert — it becomes a meaningless assignment and breaks the intended control based on the student's performance.

Impact

• Grading mechanism is non-functional — students can graduate regardless of academic performance.

• System allows undeserving students to be upgraded, undermining protocol fairness.

• Invariant is violated, making the protocol non-compliant with its own design guarantees.

• Misleading interface — users and integrators may assume that cutOffScore is enforced when it isn’t.

Tools Used

• Manual Code Review

• Slither

Recommendations

• Integrate cutOffScore enforcement directly in the graduation logic, e.g.: