Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`LevelOne::giveReview()` Incorrect review limit: `reviewCount < 5` allows more than intended

jfornells

Description:

The giveReview() function uses the condition require(reviewCount[_student] < 5) to limit the number of reviews per student. However, the system's documentation states that students must receive exactly 4 grades, one per week, over 4 weeks.

Allowing up to 5 reviews contradicts this functional invariant and may create inconsistencies in score calculations, promotions, and upgrade logic.

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
@> require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
....
}

Impact:

  • More reviews than the 4 allowed per student can be conducted.

  • The established educational logic in the documentation is broken.

  • It may affect promotion and the system's final state before the upgrade.

Proof of Concept:

The test simulates 5 consecutive weeks with one review per week. The counter reaches 5, demonstrating that reviewCount < 5 allows more reviews than the 4 permitted by the system's rules.

function test_TooManyReviewsAllowed() public {
uint256 count;
vm.prank(principal);
LevelOne(proxy).startSession(60);
uint256 count;
for (uint256 i; i < 5; i++) {
vm.warp(block.timestamp + (i + 1) * 1 weeks);
vm.prank(alice);
LevelOne(proxy).giveReview(dan, false);
count++
}
console2.log("reviews:", count);
}

Result:

Ran 1 test for test/GraduateTest.t.sol:GraduateTest
[PASS] test_TooManyReviewsAllowed() (gas: 3782820)
@> Logs: reviews: 5

Recommende Mitigation:

​
function giveReview(address _student, bool review) public onlyTeacher {
...
- require(reviewCount[_student] < 5, "Student review count exceeded!!!");
+ require(reviewCount[_student] < 4, "Student review count exceeded!!!");
....
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.