Hawk High

Summary

The LevelTwo contract contains a discrepancy between the intended teacher wage percentage outlined in the project documentation and the actual value defined in the contract. While the readme.md specifies that teachers are entitled to 35% of the bursary, the contract defines TEACHER_WAGE_L2 as 40%, leading to a potential overpayment to teachers and violation of the documented payment structure.

Vulnerability Details

Location: LevelTwo.sol, line defining TEACHER_WAGE_L2 as 40.

Expected Behavior: Per the readme.md, the payment structure for bursary distribution should be:

Principal: 5%

Teachers: 35%

Remaining Bursary: 60%

However, the LevelTwo contract implements the teacher wage as 40% (TEACHER_WAGE_L2 = 40). This misalignment introduces an inconsistency between the intended design and the actual contract logic.

Root Cause: The constant TEACHER_WAGE_L2 is incorrectly set to 40 instead of 35.

Impact

Overpayment to Teachers: Teachers receive 40% of the bursary instead of the intended 35%, reducing the amount left in the bursary for other purposes.

Principal and Bursary Mismatch: The remaining bursary after distribution may not match the expected 60%, causing potential financial discrepancies and misaligned incentives.

Contract Behavior Deviates from Specification: This inconsistency may lead to stakeholder disputes or trust issues regarding the contract's adherence to the specified rules.

Tools Used

Manual Code Review

Recommendations

Correct TEACHER_WAGE_L2 Constant:
Update the constant to align with the documented specification:

Add Automated Tests for Wage Distribution:
Implement unit tests to validate the distribution percentages and ensure future upgrades adhere to the intended payment structure.

Enhance Documentation Checks:
Include a deployment checklist or automated contract linter to verify that constant values align with external documentation.

Update Documentation if Necessary:
If 40% is the intended value, update the readme.md to reflect this change and ensure all stakeholders are informed.