Hawk High

Description:

The graduateAndUpgrade(address _levelTwo, bytes memory) function is intended to complete the educational period and update the contract's implementation to LevelTwo. However, the function does not update the inSession variable to false, leaving the system in an internal state where the session is still considered active.

This variable (inSession) is used as a control condition in various functions (e.g., addTeacher(...)) and may also be used in the new implementation (LevelTwo) to restrict actions until the session ends.

The problem is magnified because the contract's state persists after the upgrade (the proxy retains the storage). Therefore, if inSession is not modified before the upgrade, the new implementation will also operate with inSession = true, even though the session has formally ended.

Impact:

• The system may enter an inconsistent state where students have graduated, but inSession remains true.

• Functions like addTeacher(), which depend on notYetInSession, may be incorrectly blocked.

• The new implementation (LevelTwo) may operate under a false assumption, thinking the session is still active.

• It may cause partial functional denial, requiring an additional upgrade just to fix this flag.

• Confusion for users and external systems, as the apparent and actual state of the contract do not match.

Proof of Concept:

This test verifies that after completing the course and executing graduateAndUpgrade(), the inSession variable is not marked as false, leaving the system in an inconsistent state. To verify this, the slot 0 of storage is accessed directly, where inSession is packed along with principal. The byte corresponding to inSession is read, and it is confirmed to still be true, even though the session should have formally ended. This situation demonstrates that the internal state was not correctly updated before the upgrade.

Recommende Mitigation: