Submission Details
Impact:
Likelihood:
Teacher Removal Allows Potential Abuse by Principal
Summary
The removeTeacher() function lacks any access controls related to the academic season. The principal can remove teachers:
After they have started working (mid-season).
Without settling compensation.
In bulk (even more than half), breaking continuity and quality of education.
Vulnerability Details
function removeTeacher(address _teacher) public onlyPrincipal {
if (_teacher == address(0)) {
revert HH__ZeroAddress();
}
if (!isTeacher[_teacher]) {
revert HH__TeacherDoesNotExist();
}
uint256 teacherLength = listOfTeachers.length;
for (uint256 n = 0; n < teacherLength; n++) {
if (listOfTeachers[n] == _teacher) {
listOfTeachers[n] = listOfTeachers[teacherLength - 1];
listOfTeachers.pop();
break;
}
}
isTeacher[_teacher] = false;
emit TeacherRemoved(_teacher);
}
Impact
Unpaid labor from teachers.
Tools Used
manual review
Recommendations
introduce a system where:
Teachers cannot be removed mid-season.
If removed, automatic partial compensation is issued.
Limit max number of removals per season.
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.