Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Bursary Accounting Error Leading to Incorrect Fund Tracking In `LevelOne::graduateAndUpgrade`.

nhippolyt

Summary

The graduateAndUpgrade function calculates wage payments based on the current bursary value but fails to update the bursary state variable after distributing funds. This results in an inconsistent internal state where the tracked bursary does not reflect the actual remaining balance (60%), violating protocol accounting rules.

Vulnerability Details

Affected Component:

graduateAndUpgrade Function:

  • Code Flaw: The function transfers 40% of the bursary (35% to teachers, 5% to the principal) but does not reduce the bursary by the paid-out amount.

  • Protocol Violation: The documentation specifies that 60% of the bursary should remain post-upgrade, but the internal state incorrectly retains 100% of the original value.

Example:

  1. Initial bursary = 1000 USDC.

  2. graduateAndUpgrade pays out 400 USDC (40%) but leaves bursary = 1000 USDC (should be 600 USDC).

Impact

High State Inconsistency:

  • Incorrect Accounting: Subsequent interactions with the contract (e.g., future upgrades, fee calculations) will use an inflated bursary value, leading to:

    • Miscalculations in wage distributions.

    • Protocol logic relying on inaccurate financial data.

Tools Used

Recommendations

Fix: Update bursary After Payments

Adjust the bursary state variable to reflect the remaining 60%:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ... existing code ...
​
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
// Deduct total payments from bursary (40%)
bursary -= (totalTeacherPay + principalPay); // Add this line
// ... transfer logic ...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

bursary not updated

The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

bursary not updated

The bursary is not updated after wages have been paid in `graduateAndUpgrade()` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.