Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Broken Invariant in `graduateAndUpgrade` function . Missing check for the `cutoff` criteria .

shubu2581

Summary

As per the docs , any student who not have achived the cutoff criteria will not be upgraded . By missing the check for cutoff criteria we allow student to upgrade without event meeting the cutoff criteria .

Vulnerability Details

As per the docs , any student who not have achived the cutoff criteria will not be upgraded . By missing the check for cutoff criteria we allow student to upgrade without event meeting the cutoff criteria .

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src/LevelOne.sol#L295

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;// we dosent check for the cutoffscore, if any student dont achived that, upgrade should not be happening & if anybody have given <5 review
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;// q incorrect mathmatical calculation
​
_authorizeUpgrade(_levelTwo); // q cannot upgrade is sesson is not ended
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher); // q if one teacher gets blacklist no one will get the reward
}
​
usdc.safeTransfer(principal, principalPay);
}

Impact

Allow student to upgrade without even achiveing the cutoff criteria .

Tools Used

Manual review

Recommendations

check for the `cutoff` criteria, if student not achived that , then revert .

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.