Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Students Graduate with Fewer Than Four Reviews

jufel

Description: LevelOne::graduateAndUpgrade does not verify that each enrolled student has received the mandated four weekly reviews before allowing graduation. Although 'giveReview' tracks individual review calls, there is no check in the graduation logic to ensure 'reviewCount[student] >= 4' (or exactly 4) prior to performing upgrades and payouts.

Impact: A principal can invoke graduateAndUpgrade after only one, two, or three reviews per student (or even zero), allowing under-reviewed and potentially under-qualified students to graduate. This completely subverts the project’s 4-week, 4-review business invariant and may lead to undeserved upgrades, misallocated bursaries, and violation of academic rules.

Proof of Concept: Include the following test in the LevelOneAndGraduateTest.t.sol file:

function testGraduateWithOnlyOneReview() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
​
vm.prank(alice);
levelOneProxy.giveReview(harriet, true);
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, "");
// graduation bypassed the 4-review requirement
assertTrue(true);
}

Recommended Mitigation: Before any upgrade or payout in graduateAndUpgrade, enforce per-student review counts:

function graduateAndUpgrade(address _levelTwo, bytes calldata data)
public onlyPrincipal notYetInSession
{
+ for (uint i = 0; i < listOfStudents.length; i++) {
+ address s = listOfStudents[i];
+ require(reviewCount[s] == 4,
+ "Each student must receive 4 weekly reviews");
+ require(studentScore[s] >= cutOffScore,
+ "Student did not meet cutoff score");
}
…
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.