Submission Details
Severity:
After distributing salaries and performing the upgrade, the bursary is not updated.
## Summary
After distributing salaries and performing the upgrade, the bursary is not updated.
## Vulnerability Details
```diff
function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
- _authorizeUpgrade(_levelTwo);
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
+ bursary = bursary - principalPay - totalTeachers * payPerTeacher;
+ _authorizeUpgrade(_levelTwo);
}
```
## Impact
```
function attack() public {
// initial State add teachers and students
_teachersAdded();
_studentsEnrolled();
// principal start session
vm.prank(principal);
levelOneProxy.startSession(70);
assert(levelOneProxy.bursary() == schoolFees * 6);
// prepare for upgrade
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
// upgrade
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
assert(levelOneProxy.getSessionStatus() == true);
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
// check bursary
assert(levelTwoProxy.bursary() != usdc.balanceOf(address(levelTwoProxy)));
// Outcome: After distributing salaries and performing the upgrade, the bursary is not updated.
// Implications: Causing a discrepancy between the actual tuition balance and the value recorded in the contract.
}
```
## Recommendations
Update bursary before upgrade
Updates
Lead Judging Commences
yeahchibyke 3 months ago
Submission Judgement Published Assigned finding tags:
bursary not updated
The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.