Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Principal can upgrade the system even if school's sessionEnd has not reached

mosmoker

Summary

This bug allows the Principal to upgrade the system to claim the rewards and graduate the students, before the LevelOne::sessionEnd has reached. giving the Principal the ability to upgrade the contract at any time, which obviously breaks the protocl rules : System upgrade cannot take place unless school's sessionEnd has reached

Vulnerability Details

1- Navigate to test/LeveOnelAndGraduateTest.t.sol file.

2- Add the following PoC code to the test file:

function testSystemUpgradableEvenSessionEndHasNotReached() public {
_teachersAdded();
_studentsEnrolled();
​
address levelTwo = makeAddr("levelTwo");
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.prank(principal);
levelOneProxy.startSession(70);
​
assertEq(usdc.balanceOf(principal), 0); // balance of principal is 0, indicating that system is not upgradable yet
​
console2.log("Session end At : ", levelOneProxy.getSessionEnd());
console2.log("Current block timestamp : ", block.timestamp);
​
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(levelTwo, data);
​
assertEq(
usdc.balanceOf(principal),
(levelOneProxy.bursary() * 5) / 100 // balance of principal is 1500 usdc, indicating that system has been upgraded successfully
);
}

3- In the command line, run the following command: forge test --match-test testSystemUpgradableEvenSessionEndHasNotReached -vvv

4- The output would be:

Session end At : 2419201
Current block timestamp : 1
​
Suite result: ok. 1 passed; 0 failed; 0 skipped

Impact

  • Students and teachers will no longer have guarantees that rules are enforced, which could lead to loss trust.

  • giving Principal the ability to update the contract to claim the rewards quicker and graduate the students before the school session passed (4 weeks), which is not guarantee for the students to take their reviews and complete their study period probably.

Tools Used

  • Manual Recon.

  • foundry Test Suite.

Recommendations

in the LevelOne::graduateAndUpgrade function add the following check at the beginning:

if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
+ if (sessionEnd >= block.timestamp) {
+ revert();
+ }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.