Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

H-05: `reviewCount` Not Incremented, Breaking Review Logic and Invariants

albert

Summary

The reviewCount[_student] state variable is checked in giveReview but never incremented. This means reviewCount always remains 0, breaking the logic for limiting reviews per student and making it impossible to satisfy the "student must have 4 reviews" invariant for graduation.

Vulnerability Details

In LevelOne.sol#giveReview:

function giveReview(address _student, bool review) public onlyTeacher {
// ...
require(reviewCount[_student] < 5, "Student review count exceeded!!!"); // Checks reviewCount
// ...
// lastReviewTime[_student] = block.timestamp; // Updated
// reviewCount[_student] is NOT incremented here
// ...
}

Since reviewCount[_student] starts at 0 and is never changed, the condition reviewCount[_student] < 5 (or < 4 after M-01 fix) will always be true for the initial checks. This means a student can theoretically receive one review per week indefinitely, rather than being limited to 4 for the session.

Impact

The core logic for tracking the number of reviews a student has received is broken. This directly impacts:

  1. The ability to limit reviews to the intended 4 per session.

  2. The invariant check during graduateAndUpgrade that requires students to have 4 reviews, as this check will always fail if reviewCount is 0, or will be based on incorrect data.
    This makes the review system unreliable and prevents correct enforcement of graduation requirements.

Tools Used

Manual Review, Logical Analysis.

Recommendations

Increment reviewCount[_student] within the giveReview function after a review is successfully recorded.

(The code modification for this is combined with M-01 in the giveReview function shown below M-01.)

// src/LevelOne.sol
// ... (other parts of the contract) ...
​
function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
​
// --- START OF MODIFICATION FOR M-01 (Correct Review Limit) ---
// Original: require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(reviewCount[_student] < 4, "HH__MaxReviewsReached"); // MODIFIED: Allows reviews when count is 0, 1, 2, 3
// --- END OF MODIFICATION FOR M-01 ---
​
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) { // where `false` is a bad review and true is a good review
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp; // Update last review time
​
// --- START OF MODIFICATION FOR H-05 (Increment reviewCount) ---
reviewCount[_student]++; // ADDED: Increment the student's review count
// --- END OF MODIFICATION FOR H-05 ---
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
​
// ... (other parts of the contract) ...
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.