There is no check in addTeacher
function if input address is currently the address of the Principal.
Adding Principal as Teacher causes the principal to receive his 5% and payment for Teacher.
Proof of Concept:
GitHub Link: LeveOnelAndGraduateTest.t.sol
As we can see after adding the Principal as a Teacher and run the test
we observe that the Principal receives his part of the payment + the part for a teacher.
Also this gives him full rights as the Teachers.
Malicious Principal (if it's possible for Principal to be malicious) can maximise his rewards by using his advantage to be the both roles at the same time
and remove part of the teachers or all except him.
Manual Review
Adding a check in addTeacher
solves the issue - the Principal address prevented from participating as Teacher.
Principal can add themselves as teacher and share in teacher pay upon graduation
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.