Hawk High

Summary:

The Levelone::graduateAndUpgrade function loops through the listOfTeachers array in order to initiate payPerTeacher invariant. However, if the listOfTeacher array becomes large, the more expensive the gas cost is and this might cause a gas block limit and might cause the entire transaction to revert.

Vulnerability Details:

This vulnerability is most likely to happen if the principal address is compromised in a number of ways, the method i am focused on is when a malicious actor deploys or upgrades a contract and assigns themselves as principal and inflate the listOfTeachers intentionally to brick the contract.

Impact

The vulnerability will cause the upgrade to be blocked and the contract become stuck in Levelone. Furthermore, funds will be locked because bursary needed to be distributed in the same transaction.

Proof of Concept:

If we have 2 sets of teachers; their gas cost becomes

Initial teachers(2) = 124,202

Inflated teachers (100) = 5,112,844

the gas cost for inflated teachers will be a lot higher than that of the initial teachers, because of the for loop.

```javascript
@> for (uint256 n = 0; n < totalTeachers; n++) {

usdc.safeTransfer(listOfTeachers[n], payPerTeacher);

}
```

Here the attacker or rouge principal can cause a DoS when Inflate the listOfTeacher array with a 100 addresses, and then call the safeTransfer function which will cost the transaction a lot of gas cost. Hereby, breaking the functionality of the contract.

Proof of Code:

<details>

<summary>PoC</summary>

place the following test into LevelOneAndGraduateTest

</details>

Tools Used

Recommendations:

1. Implementing a hard limit of teachers in the listOfTeachers array

   javascript````require(listOfTeachers.length <= 50, "Too many teachers");

2. Use a pull over push method of transfer, Instead of sending USDC in a loop, record the amount owed, and let teachers withdraw individually by creating withdraw function to spread gas costs and removes the block-limit risk.

   mapping(address => uint256) public pendingPayments;

   ​

   function graduateAndUpgrade(...) public onlyPrincipal {

   ​

   for (uint256 n = 0; n < totalTeachers; n++) {

   pendingPayments[listOfTeachers[n]] += payPerTeacher;

   }

   ​

   pendingPayments[principal] += principalPay;

   ​

   _authorizeUpgrade(_levelTwo)

   ​

   ​

   function withdraw() external {

   uint256 amount = pendingPayments[msg.sender];

   require(amount > 0, "Nothing to withdraw");

   pendingPayments[msg.sender] = 0;

   usdc.safeTransfer(msg.sender, amount);

   }

   ​

   \