Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The System upgrade can occur while we are still in-Session

0xkujen

Summary

One of our system invariants is that System upgrade cannot take place unless school's sessionEnd has reached. However, we can still manage to do the system upgrade while the session is still active.

Vulnerability Details

The upgradeAndUpdate function can be called and executed successfully with a successful system upgrade just after making a call to the startSession function without checking if we are still in session or not.

Proof of Concept:

function testSystemUpgradeAndGraduationCanOccurBeforeSessionEnd() public {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
_studentsEnrolled();
_teachersAdded();
vm.startPrank(principal);
levelOneProxy.startSession(70); //this sets inSession to true
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
// the test passes just fine, which means it was upgraded and the graduation took place
}

Impact

  • System can be upgraded during session which can lead to students who have not still gotten their reviews to not get upgraded and for their schoolFees paid to the school to be distributed.

Tools Used

Manual source code review


Recommendations

Add a check to validate that the school session is over before going through with the upgrade:

error HH__SchoolStillInSession();
function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
if (inSession==true){
revert HH__SchoolStillInSession();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo); // used to authorize who can upgrade the contract, you have to pass the new implementation address to it
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher); // pay the teachers
}
​
usdc.safeTransfer(principal, principalPay); // pay the principal
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.