Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing check for `principal` in function `addTeacher`

shubu2581

Summary

In function addTeacher we are missing check that is msg.sender = principal . Principal can add itself as a teacher and withdraw the salary of teacher and principal both .

Vulnerability Details

In function addTeacher we are missing check that is msg.sender = principal . Principal can add itself as a teacher and withdraw the salary of teacher and principal both .

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L201

function addTeacher(address _teacher) public onlyPrincipal notYetInSession {
if (_teacher == address(0)) {
revert HH__ZeroAddress();
}
​
if (isTeacher[_teacher]) {
revert HH__TeacherExists();
}
​
if (isStudent[_teacher]) {
revert HH__NotAllowed(); // q check that principal can also not set himself as teacher and takes salary
}
​
listOfTeachers.push(_teacher);
isTeacher[_teacher] = true;
​
emit TeacherAdded(_teacher);
}
​
​

Impact

Principal can add itself as a teacher and can withdraw the salary or can manipulate the review of the student . Drawing salary as teacher and principal both can lead to the loss of funds to the protocol .

Tools Used

manual review

Recommendations

Add check . So, that if principal tries to add itself as a teacher it will revert .

function addTeacher(address _teacher) public onlyPrincipal notYetInSession {
if (_teacher == address(0)) {
revert HH__ZeroAddress();
}
​
if (isTeacher[_teacher]) {
revert HH__TeacherExists();
}
​
if (isStudent[_teacher]) {
revert HH__NotAllowed();
}
​
if (isPrincipal[_teacher]){
revert HH__NotAllowed();
}
​
listOfTeachers.push(_teacher);
isTeacher[_teacher] = true;
​
emit TeacherAdded(_teacher);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

principal can become teacher

Principal can add themselves as teacher and share in teacher pay upon graduation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.