Hawk High

Summary

The LevelOne contract lacks a proper mechanism to automatically filter out students who don't meet the cutoff score during graduation. According to the project requirements, "Any student who doesn't meet the cutOffScore should not be upgraded" when the Principal upgrades the system. However, the current implementation of graduateAndUpgrade() does not include this critical logic, forcing the Principal to manually track failing students and expel them one by one - an impractical and error-prone process.

Vulnerability Details

The graduateAndUpgrade() function in LevelOne.sol handles the upgrade process but doesn't implement the filtering of students based on their scores:

The function:

1. Performs the upgrade to the new implementation

2. Distributes wages to teachers and principal

3. But does not filter students based on their scores

This omission forces the Principal to use the expel() function individually for each failing student, which is:

• Highly manual and time-consuming

• Prone to human error (students might be incorrectly promoted or expelled)

• Difficult to scale with a large number of students

Impact

This vulnerability fundamentally undermines the academic progression model of the system:

1. Academic Integrity: All students automatically progress regardless of performance, eliminating accountability and incentives to maintain good academic standing

2. Manual Overhead: The Principal must track scores offline and manually expel each failing student, creating significant operational overhead

3. Inconsistent Application: Manual expulsion increases the risk of inconsistent application of academic standards

4. System State Inconsistency: If the Principal forgets to expel failing students before upgrading, those students will incorrectly progress to the next level

This issue is particularly severe because it contradicts an explicit invariant of the system stated in the README: "Any student who doesn't meet the cutOffScore should not be upgraded".

Proof of Concept

failing students are not automatically filtered during graduation.

Tools Used

• Manual code review

• Analysis of contract logic against system requirements

Recommendations

Implement automatic student filtering in the graduateAndUpgrade() function