Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of session end validation allows premature upgrades and fund distribution

jfornells

Description:

The LevelOne::graduateAndUpgrade function in the LevelOne contract allows the principal to upgrade the implementation and distribute the bursary fund among teachers and themselves.

However, it does not validate that the session has ended (sessionEnd) before executing this action. This means the principal can call the function at any time, including before the session formally ends, violating the system's intended temporal logic.

This lack of validation breaks the contract's lifecycle integrity and may allow:

  • Artificially ending the school period earlier than expected.

  • Distributing funds before all students have been evaluated or graduated.

Impact:

  • Manipulation of the system's lifecycle by the principal, causing an early session end without any temporal limitation.

  • Unfair or premature fund distribution before all students and teachers have completed their process.

  • Business logic violation: the graduate() function in LevelTwo may depend on the condition that the session has ended and will not activate in the correct order.

Proof of Concept:

  1. The principal starts the session, setting sessionEnd to 4 weeks.

  2. Time is advanced by 1 week (3 weeks remain before the course ends).

  3. The principal calls graduateAndUpgrade().

function test_SessionEnd_graduateAndUpgrade() public {
​
vm.startPrank(principal);
LevelOne(proxy).startSession(55);
​
vm.warp(block.timestamp + 1 weeks);
​
bytes memory data = abi.encodeWithSignature("graduate()");
LevelOne(proxy).graduateAndUpgrade(address(levelTwo), data);
}

  1. The test passes without issue.

[PASS] test_SessionEnd_graduateAndUpgrade() (gas: 4023632)

Recommended Mitigation:

Add a validation in LevelOne::graduateAndUpgrade to ensure that sessionEnd has passed.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
...
​
+ if (block.timestamp < sessionEnd) {
+ revert HH__AlreadyInSession();
+ }
...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.