Hawk High

First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Valid

Incorrect Teacher Wage Distribution Exceeds Bursary Allocation in `LevelOne::graduateAndUpgrade`.

Summary

The graduateAndUpgrade function incorrectly distributes 35% of the bursary to each teacher instead of splitting the total 35% among all teachers. This results in excessive payouts when multiple teachers exist, violating the protocol’s defined wage structure and depleting the bursary beyond intended limits.

Vulnerability Details

Affected Component:

graduateAndUpgrade Function:

  • Code Flaw: The current logic calculates payPerTeacher as (bursary * TEACHER_WAGE) / PRECISION, which allocates 35% of the bursary to each teacher (e.g., 2 teachers receive 70% total).

  • Protocol Violation: The documentation mandates that all teachers collectively share 35% of the bursary, not each teacher individually.

Example:

  • Bursary: 1000 USDC

  • Teachers: 2

  • Current Code:

    • Each teacher receives 350 USDC (35% of 1000).

    • Total teacher payout: 700 USDC (70% of bursary).

  • Intended Behavior:

    • Total teacher payout: 350 USDC (35% of 1000).

    • Each teacher receives 175 USDC (350 / 2).


Impact

Critical Fund Misallocation:

  • Bursary Overdrain: Teacher payouts exceed the allocated 35%, reducing the remaining bursary below the documented 60%.

  • Systemic Accounting Failure: Subsequent protocol operations (e.g., upgrades, refunds) will use incorrect bursary balances.

  • Protocol Halting: If multiple teachers exist, the contract may revert due to insufficient funds during transfers.


Tools Used

Recommendations

Fix: Split Total 35% Among All Teachers

Revise the wage calculation to distribute the total 35% equally:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ... existing checks ...
uint256 totalTeachers = listOfTeachers.length;
require(totalTeachers > 0, "No teachers");
// Calculate total teacher share (35% of bursary)
uint256 totalTeacherPay = (bursary * TEACHER_WAGE) / PRECISION;
uint256 payPerTeacher = totalTeacherPay / totalTeachers;
// Calculate principal share (5%)
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
// Update bursary to reflect remaining 60%
bursary -= (totalTeacherPay + principalPay);
// Transfer wages
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
// ... upgrade logic ...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.