Hawk High

First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Valid

Teacher can review a student more than four reviews

Summary

based on the following restriction in require(reviewCount[_student] < 5, "Student review count exceeded!!!"); in the LevelOne::giveReview function and the protocol rule: each student must have gotten 4 reviews the teachers are only allowed to give each student only 4 reviews. But This bug allows the teacher to review the student more than 4 times due to a broken access control in the LevelOne::giveReview function logic implementation.

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file.

2- Add the following PoC code to the test file:

function testTeacherCanReviewMoreThanFourTimes() public {
_teachersAdded();
_studentsEnrolled();
console2.log("Clara's score --> : ", levelOneProxy.studentScore(clara));
for (uint256 i = 0; i < 10; i++) {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(clara, false);
console2.log(
"Clara's score --> : ",
levelOneProxy.studentScore(clara)
);
}
console2.log(
"Clara's Final score is: ",
levelOneProxy.studentScore(clara)
);
}

3- in the command line, run the following command: forge test --match-test testTeacherCanReviewMoreThanFourTimes -vvv

4- The output will be as following:

Clara's score --> : 100
Clara's score --> : 90
Clara's score --> : 80
Clara's score --> : 70
Clara's score --> : 60
Clara's score --> : 50
Clara's score --> : 40
Clara's score --> : 30
Clara's score --> : 20
Clara's score --> : 10
Clara's score --> : 0
Clara's Final score is: 0

Impact

based on the protocol rules the teacher should only give a student only 4 reviews ( one review per a week lasts for a complete 4 weeks "the school session period" ), but this restriction is not configured well, giving the teacher the ability to fully downgrade the student review to 0 by reviewing a student with 10 negative reviews.

Tools Used

  • Manual Recon

  • foundry test suite


Recommendations

in the LevelOne::giveReview function add the following line of code :

lastReviewTime[_student] = block.timestamp;
+ reviewCount[_student] += 1 ;
Updates

Lead Judging Commences

yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.