Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Teachers can submit more than 4 reviews per student due to not incrementing `reviewCount` mapping after each review

d4r3_w0lf

Summary

Teachers are allowed to submit only one review per student per week, for a total of four weeks. By the end of the session, every student must have received all four weekly reviews in order to system upgrade. Otherwise the system is not upgraded.

Vulnerability Details

After a review the 'reviewCount' mapping is not updated. This leads to teachers can give any more than 4 reviews but one per student per week because this check is always true
require(reviewCount[_student] < 5, "Student review count exceeded!!!");

vulnerable code:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
//@audit reviewCount is not updating
emit ReviewGiven(_student, review, studentScore[_student]);
}

Impact

  • Breaks invariant of the protocol

Tools Used

  • Manual Analysis

Recommendations

Update the reviewCount mapping after each review

Updated Code:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
+ reviewCount[_student] += 1;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.