Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

The function `startSession()` does not have a modifier or check to ensure a minimum number of enrolled students for a session to start. wasting time.

ayomiposi233

Summary

There is no check to ensure that at least a minimum number of students are enrolled before the function startSession()can be called, this can cause a malicious principal to call the function and waste 4 weeks.

Vulnerability Details

If the Principal is malicious, they can call the startSession() without any enrolled students and waste 4 weeks.

Impact

The protocol invariant is broken because the principal and teachers, if any, will not get paid as there is no bursary.

poc

The test below passes and proves that without any students enrolled, startSession()can be called by the principal.

function test_startSessionWithoutStudents_poc() public {
vm.startPrank(principal);
levelOneProxy.startSession(70);
vm.stopPrank();
​
bool inSession = levelOneProxy.getInSession();
uint256 cutOffScore = levelOneProxy.getCutOffScore();
​
assert(inSession == true);
assert(cutOffScore == 70);
assert(levelOneProxy.sessionEnd() > block.timestamp);
}

Tools Used

Manual review.

Recommendations

Consider creating a local variable uint256 minimumEnrolledStudents = n where n must be > 0 in the startSession()function and then adding the check as shown below to ensure that there are a number of students enrolled before it is called;

function startSession(uint256 _cutOffScore) public onlyPrincipal notYetInSession {
+ uint256 minimumEnrolledStudents = n
+ require(listOfStudents.length > minimumEnrolledStudents, revert())
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore;
​
emit SchoolInSession(block.timestamp, sessionEnd);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.