Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Student with review count less than 4 can still graduate

0xkujen

Summary

One of our contract's invariants is that students must have 4 review in order to graduate, however, students can still graduate with only 3 reviews.

Vulnerability Details

The graduateAndUpgrade function does not implement a check that a student must have 4 reviews for them to graduate. Therefore, a student with only 3 review can still graduate and exist in the LevelTwo upgraded contract.

Proof of Concept:

function testStudentCanGraduateWithReviewCountSmallerThanFour() public {
_studentsEnrolled();
_teachersAdded();
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.startPrank(alice);
// reviews dan student 3 times
vm.warp(0);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.stopPrank();
vm.startPrank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
address[] memory students = levelTwoProxy.getListOfStudents();
for (uint256 i = 0; i < students.length; i++) {
console2.log("Student", i, students[i]);
}
assertEq(students[1], dan);//assure that our 2nd student dan is within the graduated students list
vm.stopPrank();
}

Impact

  • Students can graduate with only 3 reviews which breaks the invariant of student having 4 reviews in order for them to qualify.

Tools Used

Manual source code review.

Recommendations

Include a check to validate that all students have 4 reviews before the session ends, else, remove that student from the studentsList and graduate the rest of the students.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.