Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Teacher Payment Distribution in LevelOne Contract

igorwarkocz

Summary

The graduateAndUpgrade function in LevelOne.sol incorrectly distributes teacher payments, giving each teacher 35% of the total bursary instead of sharing the 35% among all teachers.

Vulnerability Details

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
...
​
uint256 totalTeachers = listOfTeachers.length;
// Each teacher will receive 35% of the bursary which is not correct (35% should be shared among all teachers)
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
...
}

Each teacher receives 35% of the total bursary, and total teacher payment should be 35% shared among all teachers.

Current implementation: payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION this means if there are 3 teachers, they would receive 105% of the bursary (35% each) which is inconsistent with the protocol assumptions.

Impact

High: This vulnerability:

  • Could drain the entire bursary if there are multiple teachers

  • May leave insufficient funds for principal payment

  • Makes the payment system unsustainable

  • Could lead to financial losses for the school

Tools Used

Manual code review

Recommendations

Fix teacher payment calculation in graduateAndUpgrade:

  1. Calculate total teacher payment as 35% of bursary

  2. Divide total teacher payment by number of teachers

  3. Add validation to ensure total payments don't exceed bursary

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.