Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

L-01: `expel()` Function Reverts Without Error Message When Session Not Active

albert

Summary

The expel function in LevelOne.sol checks if (inSession == false) and uses a bare revert() if the condition is met. This provides no information to the caller about why the transaction failed.

Vulnerability Details

// In LevelOne.sol#expel
if (inSession == false) {
revert(); // Bare revert
}

When a transaction reverts with revert(), it doesn't include an error string or custom error, making debugging harder for users and off-chain systems.

Impact

Reduced diagnosability. Users or developers interacting with the contract will see a generic revert and will have to deduce the cause, rather than getting a clear error message indicating the session is not active.

Tools Used

Manual Review.

Recommendations

Use a require statement with a descriptive message or a custom error for better revert reasons.

Code Modification for LevelOne.sol::expel:

// src/LevelOne.sol
// ... (other parts of the contract) ...
​
function expel(address _student) public onlyPrincipal {
// --- START OF MODIFICATION FOR L-01 ---
// Original:
// if (inSession == false) {
// revert();
// }
require(inSession, "HH__NotInSession"); // MODIFIED: Use require with a reason string or custom error
// --- END OF MODIFICATION FOR L-01 ---
​
if (_student == address(0)) {
revert HH__ZeroAddress();
}
​
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
​
uint256 studentLength = listOfStudents.length;
for (uint256 n = 0; n < studentLength; n++) {
if (listOfStudents[n] == _student) {
listOfStudents[n] = listOfStudents[studentLength - 1];
listOfStudents.pop();
break;
}
}
​
isStudent[_student] = false;
​
emit Expelled(_student);
}
​
// ... (other parts of the contract) ...
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.