Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing `reviewCount` Completion Check on Students Before graduateAndUpgrade, Allowing Premature System Upgrade

muh_jehanzaib

Description:
The graduateAndUpgrade function is intended to execute only after the school session concludes, rewarding participants and upgrading the contract to the next level. However, it currently lacks a critical check: verifying that all students have received the required four reviews (i.e., one per week over four weeks) before proceeding with the upgrade.

This oversight allows the contract upgrade to occur even when some students have not been fully reviewed by the teachers. This directly contradicts the contract’s intended logic and academic fairness, which assumes all students are evaluated consistently over the duration of the session.

Impact

  • Premature Upgrade: The contract can be upgraded even if the academic session hasn’t concluded or not all students have been fairly reviewed.

  • Inconsistent Evaluation: Students may graduate to the next level without being fully evaluated, potentially violating the intended rules of academic progression.

  • System Integrity Flaw: Violates the assumed logic that performance and reviews influence graduation and upgrade eligibility.

POC

function test_reviewCountIncreasingByAddingReviewsByTeacher() public schoolInSession {
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(harriet, false);
assert(levelOneProxy.reviewCount(harriet) == 0);
}
​
function test_confirm_can_upgradeWithoutCheckReviewCount() public {
test_reviewCountIncreasingByAddingReviewsByTeacher();
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
​
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
​
console2.log(levelTwoProxy.bursary());
console2.log(levelTwoProxy.getTotalStudents());
}

Recommended Mitigation

Update graduateAndUpgrade to:

  • Ensure the session has ended.

  • Iterate through all enrolled students to confirm each has received 4 reviews.

require(block.timestamp >= sessionEnd, "Session has not ended");
​
for (uint256 i = 0; i < listOfStudents.length; i++) {
address student = listOfStudents[i];
require(reviewCount[student] == 4, "All students must have 4 reviews before upgrade");
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.