Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Review Count Not Incremented Allows Unlimited Reviews

invcbull

Summary

The giveReview function checks the review count but never increments it, allowing teachers to submit unlimited reviews for a student within or not even submit a review for a student at all and the student wlll still graduate and this breaks the core invariant that students must go through 4 reviews (one weekly) before they can be graduated .

Vulnerability Details

Root Cause: In LevelOne.sol, the giveReview function checks reviewCount but doesn't increment it after a review is given:

function giveReview(address _student, bool review) public onlyTeacher {
// ...existing code...
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
// Missing: reviewCount[_student]++;
// ...existing code...
}

Initial State:

  • School in session

  • Teacher registered

  • Student enrolled with initial score of 100

Attack Flow:

  1. Teacher calls giveReview with review = false

  2. Student score decreases by 10

  3. Teacher can call giveReview again more than 4 times

  4. Process can be repeated until student score reaches 0

Impact

  • Teachers can submit unlimited negative reviews

  • Student scores can be maliciously reduced to 0

  • Compromises the entire grading system

POC

function testUnlimitedReviews() public {
// Setup
address student1 = makeAddr("student1");
address teacher1 = makeAddr("teacher1");
// Add teacher and enroll student
vm.prank(principal);
levelOneProxy.addTeacher(teacher1);
vm.startPrank(student1);
usdc.mint(student1, schoolFees);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
// Start session
vm.prank(principal);
levelOneProxy.startSession(70);
// Initial score should be 100
assertEq(levelOneProxy.studentScore(student1), 100);
vm.startPrank(teacher1);
// First review
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(student1, false); // Score = 90
// Second review - warp another week
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(student1, false); // Score = 80
// Third review - warp another week
vm.warp(block.timestamp + 1 weeks);
levelOneProxy.giveReview(student1, false); // Score = 70
vm.stopPrank();
// Score should be reduced multiple times across weeks
assertEq(levelOneProxy.studentScore(student1), 70);
}

Recommendations

Add review count increment:

function giveReview(address _student, bool review) public onlyTeacher {
// ...existing code...
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
// Increment review count
reviewCount[_student]++;
// ...rest of the function...
}

}

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.