Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

M-02: Student Score Underflow in `giveReview` Leads to Inflated Scores

albert

Summary

The studentScore in LevelOne.sol can underflow when a student with a score less than 10 receives a bad review (studentScore[_student] -= 10;). This results in the student's score wrapping around to a very large positive number, potentially allowing them to incorrectly meet the cutOffScore and graduate.

Vulnerability Details

In LevelOne.sol#giveReview, when review is false, the student's score is decreased:

// ...
if (!review) {
studentScore[_student] -= 10; // Potential underflow
}
// ...

studentScore is a uint256 and starts at 100. If a student receives enough bad reviews for their score to drop below 10 (e.g., score is 5), the operation 5 - 10 will cause an underflow, and studentScore[_student] will become type(uint256).max - 4.

Impact

  1. Incorrect Student Scores: A student with a very poor performance record could, due to underflow, end up with an extremely high score.

  2. Compromised Graduation Logic: The system relies on studentScore to determine if a student meets the cutOffScore for graduation. An artificially inflated score due to underflow can lead to undeserving students being marked as graduated and potentially moved to LevelTwo. This undermines the academic integrity of the Hawk High system and violates the invariant "Any student who doesn't meet the cutOffScore should not be upgraded".

Tools Used

Manual Review, Logical Analysis.

Recommendations

Ensure that studentScore does not underflow. The score should not go below a defined minimum, typically 0.

Code Modification for LevelOne.sol::giveReview:

// src/LevelOne.sol
// ... (other parts of the contract) ...
​
function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
​
// Assuming M-01 (Correct Review Limit) is fixed:
require(reviewCount[_student] < 4, "HH__MaxReviewsReached");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
// --- START OF MODIFICATION FOR M-02 ---
if (studentScore[_student] >= 10) {
studentScore[_student] -= 10;
} else {
studentScore[_student] = 0; // Set to 0 if subtracting 10 would underflow
}
// --- END OF MODIFICATION FOR M-02 ---
}
​
// Update last review time
lastReviewTime[_student] = block.timestamp;
​
// Assuming H-05 (Increment reviewCount) is fixed:
reviewCount[_student]++;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
​
// ... (other parts of the contract) ...
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.