Hawk High

Summary

If the cutoffscore value is set to zero, it allows all students to graduate, bypassing the intended checks and breaking the system's invariant, which should only allow students to graduate once certain conditions are met.

Vulnerability Details

The cutoffscore value, which is part of the graduation condition, can be mistakenly set to zero. This results in all students meeting the graduation requirement, as the cutoff is used to determine if the student should graduate. When set to zero, every student's score would automatically qualify them for graduation, breaking the intended logic and potentially allowing unauthorized graduations.

POC:

Add this code in LevelOneAndGraduateTest.t.sol

Impact

• All students could graduate regardless of their actual performance, leading to a significant integrity issue within the system.

• This could undermine the entire grading and progression mechanism, allowing students who haven’t met the necessary requirements to be considered graduated.

Tools Used

Foundry

Recommendations

• Ensure that the cutoff value is validated before being set, and that it cannot be zero.

• Implement a check for valid cutoff values and add a default minimum value (e.g., 1) to avoid zero cutoff.

• Consider adding a fallback mechanism to handle edge cases like this where the value is unexpectedly zero.