Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

No protection against premature system updates

arinthal

Summary

The LevelOne contract lacks a mechanism to prevent the director from performing a system upgrade before the session end date, which is defined as 4 weeks from the session start.

Impact

Violation of invariant rules: "System upgrade cannot take place unless school's sessionEnd has reached".

Proof of Code

Add the following code to the LevelOneAndGraduateTest.t.sol file within the LevelOneAndGraduateTest contract.

function test_confirm_can_graduate_and_upgrade_before_session_end()
public
schoolInSession
{
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
// this call is possible, despite the fact that the end of the session has not yet passed
assert(block.timestamp < levelOneProxy.getSessionEnd());
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
}

Tools Used

  • Manual Review

  • Foundry

Recommended Mitigation

Ensure that the system cannot be updated before the end of the session. One of the possible ways we see below.

We need to update the code below in the LevelOne.sol file.

+ error HH__SessionNotEnded();
function graduateAndUpgrade(
address _levelTwo,
bytes memory
) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
+ if (block.timestamp < sessionEnd) {
+ revert HH__SessionNotEnded();
+ }
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

The changes above ensure that the function can only be executed after the session period has ended.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.