Hawk High

Summary
Anyone can initialize the contract and set themselves as the principal.

Vulnerability Details
Root Cause: The initialize function does not restrict who can set the principal:

principal = _principal;

Initial State: The contract is deployed.

Step 1: An unauthorized user initializes the contract.

Outcome: The unauthorized user becomes the principal.

Implications: The contract can be drained or misused.

Impact
Who is affected: The school system.

How they are affected: Unauthorized access could lead to loss of funds.

Tools Used
manuel review

Recommendations
Restrict initialization to the deployer:

require(msg.sender == deployer, "Not authorized");