Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Missing Session Guard on 'removeTeacher'

jufel

Description: LevelOne::removeTeacher lacks the 'notYetInSession' modifier. A malicious or mistaken principal can remove teachers in the middle of an active session.

Impact: If all teachers are removed mid-session, LevelOne::graduateAndUpgrade will compute 'totalTeachers == 0', causing a division-by-zero or a zero-teacher payout—either way, graduation will revert and funds lock up.

Proof of Concept:

Note: this PoC assumes that the 'Incorrect Teacher-Pay Calculation' issue has already been fixed, so that graduateAndUpgrade gets as far as splitting by totalTeachers instead of reverting earlier.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
…
uint256 totalTeachers = listOfTeachers.length;
+ uint256 totalTeacherShare = (bursary * TEACHER_WAGE) / PRECISION;
+ uint256 payPerTeacher = totalTeacherShare / totalTeachers;
- uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
…
}

After this fix include the following test in the LevelOneAndGraduateTest.t.sol file:

function testGraduateReverts() public schoolInSession {
vm.startPrank(principal);
levelOneProxy.removeTeacher(alice);
levelOneProxy.removeTeacher(bob);
vm.stopPrank();
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.startPrank(principal);
vm.expectRevert();
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
vm.stopPrank();
}

Recommended Mitigation: Add 'notYetInSession' to 'removeTeacher':

- function removeTeacher(address _teacher) public onlyPrincipal {
+ function removeTeacher(address _teacher) public onlyPrincipal notYetInSession {
…
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.