Hawk High

Summary
The principal can add themselves as a teacher, allowing them to collect payments as both the principal and a teacher.

Vulnerability Details
Root Cause: The addTeacher function does not prevent the principal from being added as a teacher:

listOfTeachers.push(_teacher);

isTeacher[_teacher] = true;

Initial State: The principal is the only authorized user to add teachers.

Step 1: The principal calls addTeacher with their own address.

Outcome: The principal is added to the listOfTeachers and marked as a teacher.

Implications: The principal can collect payments as both a teacher and the principal, leading to unfair distribution of funds.

Impact
Who is affected: Teachers and the fairness of the payment system.

How they are affected: Teachers may receive less payment due to the principal exploiting the system.

Tools Used
manuel review

Recommendations
Add a check in the addTeacher function to prevent the principal from being added as a teacher:

if (_teacher == principal) {

revert HH__NotAllowed();

}