Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Teacher can unlawfully not receive their money if they did their work but got expelled before graduation

0xkujen

Summary

A teacher must be able to receive their money for their work even after being expelled. However an expelled teacher who worked but got expelled before graduation will not.

Vulnerability Details

If the principal expels a teacher who did their work just before the graduation, that teacher will not receive their wage for the work they did during the session.

Proof of Concept:

function testTeacherCanNotReceiveTheirWageIfExpelledAfterGivingReviewsAndBeforeGraduation() public {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.startSession(70);
vm.stopPrank();
vm.startPrank(alice);
// reviews the clara students 4 times and is eligible to get paid
vm.warp(0);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(clara, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(clara, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(clara, false);
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(clara, false);
vm.stopPrank();
vm.startPrank(principal);
levelOneProxy.removeTeacher(alice); // removed from the teachers list
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
vm.stopPrank();
vm.assertEq(0, usdc.balanceOf(alice)); // didnt receive any USDC amount
​
}

Impact

  • Teachers will be unlawfully not receiving their wages for the work they did.

Tools Used

Manual source code review.

Recommendations

  • Add a seperate list and logic to evaluate the teacher based on how many reviews they have given, and pay them their wages accordingly to that in case they are to be expelled before graduation.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.