Hawk High

First Flight #39

Beginner FriendlySolidity

100 EXP

View results

Previous Next

Submission Details

Severity: low

Valid

[m] graduateAndUpgrade() lacks a check for sessionEnd

wiasliaw

Vulnerability Details

In graduateAndUpgrade(), there is not check whether the session is end.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {

// check: address zero

if (_levelTwo == address(0)) {

revert HH__ZeroAddress();

}

uint256 totalTeachers = listOfTeachers.length;

uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;

uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;

// check: access of onlyPrincipal

_authorizeUpgrade(_levelTwo);

for (uint256 n = 0; n < totalTeachers; n++) {

usdc.safeTransfer(listOfTeachers[n], payPerTeacher);

}

usdc.safeTransfer(principal, principalPay);

}

Impact

The invariant that “System upgrade cannot take place unless school's sessionEnd has reached” is broke, because principal can upgrade the system at any time.

PoC

In LevelOneAndGraduateTest.sol#test_confirm_can_graduate(), the schoolInSession modifier ensures that the session is still active. However, the test still passes, indicating that the principal can upgrade the system during an active session.

// SPDX-License-Identifier: SEE LICENSE IN LICENSE

pragma solidity 0.8.26;

import {Test, console2} from "forge-std/Test.sol";

import {DeployLevelOne} from "../script/DeployLevelOne.s.sol";

import {GraduateToLevelTwo} from "../script/GraduateToLevelTwo.s.sol";

import {LevelOne} from "../src/LevelOne.sol";

import {LevelTwo} from "../src/LevelTwo.sol";

import {MockUSDC} from "./mocks/MockUSDC.sol";

contract LevelOneAndGraduateTest is Test {

DeployLevelOne deployBot;

GraduateToLevelTwo graduateBot;

LevelOne levelOneProxy;

LevelTwo levelTwoImplementation;

address proxyAddress;

address levelOneImplementationAddress;

address levelTwoImplementationAddress;

MockUSDC usdc;

address principal;

uint256 schoolFees;

// teachers

address alice;

address bob;

// students

address clara;

address dan;

address eli;

address fin;

address grey;

address harriet;

function setUp() public {

deployBot = new DeployLevelOne();

proxyAddress = deployBot.deployLevelOne();

levelOneProxy = LevelOne(proxyAddress);

// graduateBot = new GraduateToLevelTwo();

usdc = deployBot.getUSDC();

principal = deployBot.principal();

schoolFees = deployBot.getSchoolFees();

levelOneImplementationAddress = deployBot.getImplementationAddress();

alice = makeAddr("first_teacher");

bob = makeAddr("second_teacher");

clara = makeAddr("first_student");

dan = makeAddr("second_student");

eli = makeAddr("third_student");

fin = makeAddr("fourth_student");

grey = makeAddr("fifth_student");

harriet = makeAddr("six_student");

usdc.mint(clara, schoolFees);

usdc.mint(dan, schoolFees);

usdc.mint(eli, schoolFees);

usdc.mint(fin, schoolFees);

usdc.mint(grey, schoolFees);

usdc.mint(harriet, schoolFees);

}

modifier schoolInSession() {

_teachersAdded();

_studentsEnrolled();

vm.prank(principal);

levelOneProxy.startSession(70);

}

function test_confirm_can_graduate() public schoolInSession {

levelTwoImplementation = new LevelTwo();

levelTwoImplementationAddress = address(levelTwoImplementation);

bytes memory data = abi.encodeCall(LevelTwo.graduate, ());

vm.prank(principal);

levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);

LevelTwo levelTwoProxy = LevelTwo(proxyAddress);

console2.log(levelTwoProxy.bursary());

console2.log(levelTwoProxy.getTotalStudents());

}

function _teachersAdded() internal {

vm.startPrank(principal);

levelOneProxy.addTeacher(alice);

levelOneProxy.addTeacher(bob);

vm.stopPrank();

}

function _studentsEnrolled() internal {

vm.startPrank(clara);