Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

payPerTeacher is calculated incorrectly

bavoen

Summary

According to the documentation, the teachers should share in 35% of the bursary.

  • Payment structure is as follows:

  • principal gets 5% of bursary

  • teachers share of 35% of bursary

  • remaining 60% should reflect in the bursary after upgrade

However, the current implementation will pay every teacher 35% of the bursary.

Vulnerability Details

The vulnerability is located in the graduateAndUpgrade function of the LevelOne contract.

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

where TEACHER_WAGE is set to 35 and PRECISION is set to 100. This means that every teacher will receive 35% of the bursary.

The following test will validate that the teachers share in 35% of the bursary:

function test_teachers_share_35_percent_payment() public schoolInSession()
{
uint256 bursaryBefore = levelOneProxy.bursary();
​
assertEq(usdc.balanceOf(alice), 0);
assertEq(usdc.balanceOf(bob), 0);
​
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
​
uint256 totalTeacherPay = usdc.balanceOf(alice) + usdc.balanceOf(bob);
assertEq(totalTeacherPay, (bursaryBefore/100*35));
}

Impact

Since the teachers are paid 35% of the bursary each this would not only mean that the teachers are overpaid but also that the school will not have enough money to pay more than two teachers.
When three teachers are hired the school would have to pay 35% + 35% + 35% + 5% = 110% of the bursary. This would lead to the contract being locked since the payout will be reverted.

Tools Used

Manually reviewed the code and the documentation.

Recommendations

Calulate the pay per teacher correctly as follows:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
- uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
+ uint256 payPerTeacher = ((bursary * TEACHER_WAGE) / PRECISION) / totalTeachers;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.