Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`reviewCount` Not Incremented in `giveReview`, unexpected behavior in `graduateAndUpgrade` function while check condition for `reviewCount` == 4 to upgrade contract.

muh_jehanzaib

Description

The giveReview function is designed to allow teachers to submit weekly feedback for students. However, it fails to increment the reviewCount mapping for a student after a review is submitted. As a result, the function's limit of 5 reviews is not enforced correctly, allowing unlimited reviews by bypassing the intended cap.

Vulnerable Function

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10; // Unused CutoffScore variable
}
​
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}

Impact

  • Bypass of Review Cap: Teachers can submit unlimited reviews for a student.

  • Score Manipulation: A student's score can be unfairly or excessively reduced.

  • Contract Misbehavior: Logic relying on accurate review count becomes invalid.

POC

Assume for this proof reviewCount state varible is public

function test_reviewCountIncreasingByAddingReviewsByTeacher() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assert(levelOneProxy.reviewCount(harriet) == 0);
}

Recommended Mitigation

Add the missing line to increment the review count for the student:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
reviewCount[_student] += 1; // Fix: Increment review count
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.