Hawk High

Summary

The contract assumes that each student will receive exactly one review per week over a 4-week session. This is enforced by a reviewTime constraint (require(block.timestamp >= lastReviewTime[_student] + reviewTime)), and is aligned with the protocol invariant stating:

"Students must have gotten all reviews before system upgrade. System upgrade should not occur if any student has not gotten 4 reviews (one for each week)."

However, this logic relies heavily on the assumption that reviews will be delivered on time, every week, without delay. In reality, factors like block time variance, network congestion, or operational oversight can result in missed review windows. If even one review is missed due to such timing issues, that student will be permanently stuck — making it impossible for the entire session to complete successfully under the current rules.

Vulnerability Details

Key problem:

This restriction prevents teachers from giving a review if the required interval has not passed. If a review is delayed even slightly beyond the intended 7-day window (due to block time drift or teacher delay), the entire review schedule for that student is pushed forward, making it impossible to fit 4 reviews within the 4-week session limit.

No fallback or late-review handling logic is provided, meaning that once a week is missed, the system becomes logically blocked from completing as per the protocol rules.

Impact

• System upgrade becomes impossible due to unmet review requirements.

• A single missed or delayed review causes an entire school session to fail.

• Results in denial-of-service (DoS) at a logical level.

• Violates the invariant: “System upgrade cannot take place unless school’s sessionEnd has reached.”

• Damages student experience and principal/teacher accountability workflows.

Tools Used

• Manual review

• Specification/invariant cross-checking

• Real-world block time variance considerations

Recommendations

1. Allow grace period or catch-up reviews:

   • Loosen timing restriction to allow reviews within a flexible range (e.g., "within 6 to 9 days from last review").

   • Or, allow teachers to give reviews at any time, but limit total to 4.

2. Track review count with timestamps instead of enforcing strict week gaps.

   • For example, store an array of review timestamps and ensure there are four non-overlapping time slots across the 4-week session.

3. Add session deadline enforcement:

   • Enforce a rule that all reviews must be completed before sessionEnd, but don't require exactly 7-day spacing between reviews.