Hawk High

Summary

According to the protocol rules:

“Any student who doesn't meet the cutOffScore should not be upgraded.”
“Students must have gotten all reviews before system upgrade.”

However, in the current implementation, the graduateAndUpgrade() function:

• Does not check if each student met the cutOffScore

• Simply upgrades the system, preserving the entire listOfStudents without filtering

This violates the system's intended business logic and breaks the “graduation” invariant.

Vulnerability Details

Current graduateAndUpgrade() implementation:

There is:

• ❌ No check on reviewCount[_student]

• ❌ No check on studentScore[_student]

• ❌ No removal of students below cutoff

This allows:

• Students who should have failed to be preserved in storage

• LevelTwo to inherit invalid state, making metrics meaningless

• Potential economic or governance bugs in more complex versions

Impact

• Breaks the expected graduation process

• Invalid students persist in the upgraded contract

• May misrepresent cohort data and future payout logic

• Fails the system's core education + performance requirement

Tools Used

• Manual source code audit

• Logic reasoning

Recommendations

Implement a loop before the upgrade call that:

1. Checks each student has received 4 reviews

2. Compares their score with cutOffScore

3. Expels the student if conditions are not met

Example fix:

Place this loop just before calling _authorizeUpgrade.

This guarantees that only valid, fully-reviewed, and passing students make it into LevelTwo.