Hawk High

Description:

The LevelTwo contract, intended as the system's new implementation via the UUPS pattern, does not inherit from UUPSUpgradeable and therefore does not implement the mandatory _authorizeUpgrade(address) function. This causes any call to _upgradeToAndCall() to automatically revert when attempting to update the proxy.

The graduateAndUpgrade() function in LevelOne, responsible for performing the upgrade, will completely fail when trying to execute _authorizeUpgrade() on an implementation that does not define it. The entire transaction reverts, and no state changes occur.

Impact:

• The upgrade cannot be completed while LevelTwo is incompatible with the UUPS pattern.

• The graduateAndUpgrade() function completely reverts, and as a result:

  • Teachers do not receive their share of the bursary.

  • The principal cannot collect their portion either.

• The system remains stuck in LevelOne, with no possibility of migration.

• While there is no loss of funds, there is an economic denial of service for the contract's internal roles.

• A new compatible implementation or modification of the upgrade process will be required.

Proof of Concept:

The principal attempts to update the contract's implementation to LevelTwo via the graduateAndUpgrade() function.

The transaction reverts:

Recommende Mitigation:

Make LevelTwo inherit from UUPSUpgradeable and implement _authorizeUpgrade():