Hawk High

First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Valid

Missing Review Count Update Allows Infinite Reviews and Blocks Graduation

Summary

The LevelOne::giveReview function fails to increment the review count for a student after each review. As a result, students can receive unlimited reviews, and the system cannot correctly track progress toward graduation, which requires exactly 4 reviews. This breaks the intended upgrade logic.

Vulnerability Details

In the current implementation of the giveReview function, the contract does not update the reviewCount for each student after a review is given. This creates a logic flaw where:

Infinite Reviews Allowed: There is no limit or tracking, so a student can receive an unlimited number of reviews without the system being aware.

Graduation Blocked: Graduation requires exactly 4 reviews, but since reviewCount is never incremented, the system believes the student has zero reviews, making graduation unreachable.

Broken State Logic: This prevents the contract from progressing as intended, leading to a permanent stuck state for students.

POC

Add this code in LevelOneAndGraduateTest.t.sol

function testReviewCountIsStuckAtZero() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assert(levelOneProxy.getReviewCount(harriet) == 0);
}

Add this code in LevelOne.sol

function getReviewCount(address _student) external view returns (uint256) {
return reviewCount[_student];
}

Impact

Graduation Blocked: Students can never graduate since the system doesn’t recognize completed reviews.

  • Infinite Reviews: A student may be reviewed an unlimited number of times, leading to redundant or malicious activity.

  • System Stuck in Incomplete State: The upgrade or transition logic relying on review counts will fail, breaking the intended contract flow.

  • Wasted Gas: Users may unknowingly spend gas on reviews that don’t progress the student’s status

Tools Used

Foundry - Manual testing

Recommendations

Add following line in LevelOne::giveReviewinside if statement.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.