Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Teacher Pay can deplete bursary

yamthedoor

Summary

Inside the graduateAndUpgrade function, line 302, payPerTeacher calculates the pay for all teachers. It should then be divided by the amount of teachers to get the per teacher pay.

If there are three or more teachers the bursary will not have enough funds and the call will revert. If there are two teachers 75% of the bursary will be used for wages and only 25% will remain for level two.

Vulnerability Details

The bug can be seen below (line 302 in LevelOne.sol). payPerTeacher is calculated for all teachers and then each teacher is sent the amount for all teachers.

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
bursary -= payPerTeacher;
}

Impact

This violates the invariants section of the documentation, which states teachers share the 35% and the remaining 60% should be relected after upgrade.

  • Payment structure is as follows:

    • principal gets 5% of bursary

    • teachers share of 35% of bursary

    • remaining 60% should reflect in the bursary after upgrade

Tools Used

Manual review and confirmation with Foundry tests. By adding a third teacher to the _teachersAdded() helper function you can cause the test_confirm_can_graduate test to fail with a revert.

Recommendations

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 payPerTeacher = totalTeacherPay / totalTeachers;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
bursary -= payPerTeacher;
}
​
usdc.safeTransfer(principal, principalPay);
bursary -= principalPay;
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.