Hawk High

First Flight #39

Beginner FriendlySolidity

100 EXP

View results

Previous Next

Submission Details

Severity: high

Valid

[m] incorrect calculation of teachers’ payment

wiasliaw

Vulnerability Details

According to the invariant that teachers share of 35% of bursary, the implementation shows that every teacher can get 35% of bursary, not share of 35% of bursary.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {

// ...

uint256 totalTeachers = listOfTeachers.length;

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

for (uint256 n = 0; n < totalTeachers; n++) {

// every teacher gets 35% of bursary

usdc.safeTransfer(listOfTeachers[n], payPerTeacher);

}

// ...

}

Impact

Due to an error in calculating the actor teacher's fee, when there are two or more teachers in the system, paying their salaries will deplete the bursary in system.

// SPDX-License-Identifier: SEE LICENSE IN LICENSE

pragma solidity 0.8.26;

import {Test, console2} from "forge-std/Test.sol";

import {DeployLevelOne} from "../script/DeployLevelOne.s.sol";

import {GraduateToLevelTwo} from "../script/GraduateToLevelTwo.s.sol";

import {LevelOne} from "../src/LevelOne.sol";

import {LevelTwo} from "../src/LevelTwo.sol";

import {MockUSDC} from "./mocks/MockUSDC.sol";

contract LevelOneAndGraduateTest is Test {

DeployLevelOne deployBot;

GraduateToLevelTwo graduateBot;

LevelOne levelOneProxy;

LevelTwo levelTwoImplementation;

address proxyAddress;

address levelOneImplementationAddress;

address levelTwoImplementationAddress;

MockUSDC usdc;

address principal;

uint256 schoolFees;

// teachers

address alice;

address bob;

// students

address clara;

address dan;

address eli;

address fin;

address grey;

address harriet;

function setUp() public {

deployBot = new DeployLevelOne();

proxyAddress = deployBot.deployLevelOne();

levelOneProxy = LevelOne(proxyAddress);

// graduateBot = new GraduateToLevelTwo();

usdc = deployBot.getUSDC();

principal = deployBot.principal();

schoolFees = deployBot.getSchoolFees();

levelOneImplementationAddress = deployBot.getImplementationAddress();

alice = makeAddr("first_teacher");

bob = makeAddr("second_teacher");

clara = makeAddr("first_student");

dan = makeAddr("second_student");

eli = makeAddr("third_student");

fin = makeAddr("fourth_student");

grey = makeAddr("fifth_student");

harriet = makeAddr("six_student");

usdc.mint(clara, schoolFees);

usdc.mint(dan, schoolFees);

usdc.mint(eli, schoolFees);

usdc.mint(fin, schoolFees);

usdc.mint(grey, schoolFees);

usdc.mint(harriet, schoolFees);

}

function test_poc_teacher_payment() external {

// setup

_teachersAdded();

_studentsEnrolled();

// totalBursary = 30000e18

uint256 totalBursary = levelOneProxy.bursary();

// call graduateAndUpgrade()

levelTwoImplementation = new LevelTwo();

levelTwoImplementationAddress = address(levelTwoImplementation);

bytes memory data = abi.encodeCall(LevelTwo.graduate, ());

vm.prank(principal);

levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);

// assertions

assertEq(usdc.balanceOf(principal), (totalBursary * 5) / 100);

// system

assertEq(usdc.balanceOf(address(levelOneProxy)), (totalBursary * 60) / 100);

// there are two teacher in the system

// assertEq(usdc.balanceOf(alice), (totalBursary * 35) / (2 * 100));

// assertEq(usdc.balanceOf(bob), (totalBursary * 35) / (2 * 100));

}

function _teachersAdded() internal {

vm.startPrank(principal);

levelOneProxy.addTeacher(alice);

levelOneProxy.addTeacher(bob);

vm.stopPrank();

}

function _studentsEnrolled() internal {

vm.startPrank(clara);