Hawk High

Summary

The sessionEnd variable is never validated within the contract, causing the inSession flag to remain permanently true. This breaks a key system invariant, as upgrades and transitions are conditioned on the session having ended. Without proper enforcement of sessionEnd, the contract remains stuck in an active session state, preventing expected progression and system upgrades.

Vulnerability Details

The system relies on the invariant that sessionEnd must be reached for a contract upgrade to take place. However, the code fails to check if the current time has surpassed sessionEnd, meaning the inSession flag remains true indefinitely.

POC:

Add this test in LevelOneAndGraduateTest.t.sol

Impact

This creates a critical flaw:

• LevelOne contract rely on session timing (e.g., graduation) will be locked in a perpetual session state.

• Students will never graduate, and the graduateAndUpgrade function will fail because the system believes the session is still ongoing.

• Teachers can still give reviews, despite the session being over.

• Students can still enroll, even though enrollment should be closed.

• Principals can still add/remove teachers, modifying session roles outside the valid timeframe.

• Principals can expel students, even when the session is no longer active.

• Principal can upgrade levelOne to LevelTwo

This breaks the invariant and expected lifecycle of the protocol and undermines its upgradeability and progression logic.

Tools Used

Foundry

Recommendations

Implement strict session time checks across all time-sensitive functions in the contract. Specifically:

Add a modifier on all the following functions:

giveReview()

enrollStudent()

addTeacher() / removeTeacher()

expel()

This ensures that only changes can be made during session time, preserving the logical integrity of the system and preventing misuse.