Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculations for payPerTeacher in graduateAndUpgrade

rubik0n

Summary

Wrong calculations for teachers payment

Vulnerability Details

Each teacher should receive a share from the 35% of the bursary.

At the moment each teacher will receive 35% of the bursary.
The calculations here are incorrect.
GitHub Link: LevelOne.sol

Proof of Concept:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION; // The wrong calculations are located here
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

Proving this is easy - adding one more teacher leads to:

[FAIL: ERC20InsufficientBalance(0x90193C961A926261B756D1E5bb255e67ff9498A1, 9000000000000000000000 [9e21], 10500000000000000000000 [1.05e22])] test_confirm_can_graduate()

function _teachersAdded() internal {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
levelOneProxy.addTeacher(makeAddr("teacher_3"));
vm.stopPrank();
}

At: GitHub Link: LeveOnelAndGraduateTest.t.sol

There is no more funds, as each of the 3 Teachers is going to receive 35%

Impact

The rewards for teachers can cause DoS or overpaying for the teachers if they are only 2.

Tools Used

Manual Review

Recommendations

  • Change the logic for teachers rewards.

For example:

-uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
+uint256 totalPayForTeachers = (bursary * TEACHER_WAGE) / PRECISION;
+uint256 payPerTeacher = totalPayForTeachers / totalTeachers;
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.