Hawk High

Summary

The graduateAndUpgrade function incorrectly calculates teacher payments by allocating 35% of the bursary to each teacher rather than splitting the 35% evenly among all teachers. This overpayment can quickly drain the bursary beyond its intended allocation, leading to insufficient funds for the remaining protocol requirements (such as student payouts). This misallocation could result in a major financial imbalance, potentially allowing malicious manipulation of the teacher list to exploit the system.

Vulnerability Details

The function currently calculates the payment per teacher as 35% of the bursary for each teacher individually, instead of splitting that 35% equally among all teachers.

• Intended behavior: 35% of the bursary should be distributed equally among all teachers.

• Actual behavior: 35% of the bursary is allocated per teacher, resulting in overpayment when there are multiple teachers.

Example:

• Bursary = 1000 USDC

• Number of Teachers = 2

• Intended Payment per Teacher = 175 USDC (35% split between 2 teachers)

• Actual Payment per Teacher = 350 USDC (35% for each teacher, 700 USDC total)

This overpayment drains the bursary by 70% instead of the intended 35%.

Code Snippet: Vulnerable Path:

Impact

• Financial Imbalance: Overpays teachers beyond the 35% bursary allocation, potentially leaving no funds for other participants, such as students or the principal.

• Protocol Breach: Violates the expected payment structure of 5% for the principal, 35% for teachers, and 60% for students, creating an unfair distribution.

• Exploitability: Malicious actors could exploit the flaw by adding fake teachers, draining the bursary and breaking the integrity of the financial system.

• Reentrancy Risk: Failing to update the bursary after payments could leave it vulnerable to reentrancy attacks, where attackers could withdraw funds multiple times.

Tools Used

Manual review

Recommendations

To fix this issue, the code should ensure that 35% of the bursary intended for teachers is divided equally among all active teachers. Additionally, the bursary should be updated after payments to prevent double-spending and reduce the risk of reentrancy attacks.

Recommended Fix: