Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Student can get more than 4 reviews during a session

0xkujen

Summary

One of our system invariants is that students should not get more than four reviews during a session, however they can.

Vulnerability Details

Since there is no check that while attempting to give a review, we must be in session. A teacher can give a review to student before the session starts and then give him 4 reviews after the session starts which makes it a total of 5 reviews (or more depending on how many were given before the session start).

Proof of Concept:

function testStudentCanBeGivenMoreThanFourReviewsDuringASession() public {
_studentsEnrolled();
_teachersAdded();
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
//give the student 1 positive revieww before the session starts
vm.startPrank(alice);
vm.warp(0);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, true);
vm.stopPrank();
//start the session
vm.prank(principal);
levelOneProxy.startSession(70);
// give the student 4 negative reviews after the session starts
vm.startPrank(alice);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(dan, false);
vm.stopPrank();
vm.prank(principal);
// student will now graduate with a score >= the cutoff score
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
​
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
address[] memory students = levelTwoProxy.getListOfStudents();
for (uint256 i = 0; i < students.length; i++) {
console2.log("Student", i, students[i]);
}
assertEq(students[1], dan);//assure that our 2nd student dan is within the graduated students list
}

Impact

  • A student can be illegally graduated due a review being given before the session starts.

Tools Used

Manual source code review.

Recommendations

  • Add a check that validates a student can't get a review unless during the session

Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.