Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Student with review count less than 4 can still graduate

0xkujen

Summary

One of our contract's invariants is that students must have 4 review in order to graduate, however, students can still graduate with only 3 reviews.

Vulnerability Details

The graduateAndUpgrade function does not implement a check that a student must have 4 reviews for them to graduate. Therefore, a student with only 3 review can still graduate and exist in the LevelTwo upgraded contract.

Proof of Concept:

function testStudentCanGraduateWithReviewCountSmallerThanFour() public {
_studentsEnrolled();
_teachersAdded();
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.startPrank(alice);
// reviews dan student 3 times
vm.warp(0);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
console2.log(block.timestamp);
vm.stopPrank();
vm.startPrank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
address[] memory students = levelTwoProxy.getListOfStudents();
for (uint256 i = 0; i < students.length; i++) {
console2.log("Student", i, students[i]);
}
assertEq(students[1], dan);//assure that our 2nd student dan is within the graduated students list
vm.stopPrank();
}

Impact

  • Students can graduate with only 3 reviews which breaks the invariant of student having 4 reviews in order for them to qualify.

Tools Used

Manual source code review.

Recommendations

Include a check to validate that all students have 4 reviews before the session ends, else, remove that student from the studentsList and graduate the rest of the students.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!