Submission Details
Severity:
Incorrect Teacher-Pay Calculation
Description:
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
This computes 35% of bursary per teacher, not total. Distributing that to N teachers pays out bursary _ 0.35 _ N, which can exceed available funds and revert.
Impact: With multiple teachers, total payouts can exceed bursary, causing underflow.
Proof of Concept: Include the following test in the LevelOneAndGraduateTest.t.sol file:
function testOverpaymentRevert() public {
// add teachers
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
levelOneProxy.addTeacher(harriet);
vm.stopPrank();
// add student
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.prank(principal);
levelOneProxy.startSession(70);
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
// ERC20InsufficientBalance revert
vm.startPrank(principal);
vm.expectRevert();
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
vm.stopPrank();
}
Recommended Mitigation:
function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
…
uint256 totalTeachers = listOfTeachers.length;
+ uint256 totalTeacherShare = (bursary * TEACHER_WAGE) / PRECISION;
+ uint256 payPerTeacher = totalTeacherShare / totalTeachers;
- uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
…
}
Updates
Lead Judging Commences
yeahchibyke 3 months ago
Submission Judgement Published Assigned finding tags:
incorrect teacher pay calculation
`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.