Contract can be upgraded even when required conditions are not met
Summary
Function LevelOne::graduateAndUpgrade does not check the requirements mentioned in the contract invariants.
Vulnerability Details
The contract invarialts say:
System upgrade cannot take place unless school's
sessionEndhas reachedSystem upgrade should not occur if any student has not gotten 4 reviews (one for each week)
However, these requirements are not checked on the contract upgrade in function LevelOne::graduateAndUpgrade.
Impact
Contract invariants are broken.
Tools Used
Manual review
Recommendations
Check the requirements from the contract invariants.
Lead Judging Commences
cut-off criteria not applied
All students are graduated when the graduation function is called as the cut-off criteria is not applied.
can graduate without session end
`graduateAndUpgrade()` can be called successfully even when the school session has not ended
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.