Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

System Upgrade Without Complete Student Reviews

invcbull

Summary

The graduateAndUpgrade function allows system upgrades without verifying that all students have received their required 4 reviews, violating a core protocol invariant.

Vulnerability Details

Root Cause: The upgrade function lacks validation that all students have received their complete set of reviews.

function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
// ...existing code...
// Missing: Check that all students have 4 reviews
_authorizeUpgrade(_levelTwo);
// ...existing code...
}

Initial State:

  • School in session

  • Multiple students enrolled

  • Teachers giving reviews

Attack Flow:

  1. Some students receive fewer than 4 reviews

  2. Principal calls graduateAndUpgrade

  3. System upgrades despite incomplete reviews

  4. Students lose opportunity for remaining reviews

Impact

  • Students graduate without complete evaluation

  • Breaks core educational requirement

  • Compromises assessment integrity

  • Violates protocol invariant: "Students must have gotten all reviews before system upgrade"


Tools Used

Manual review

Recommendations

Add review completion check:


function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
// ...existing code...

uint256 totalStudents = listOfStudents.length;
for(uint256 i = 0; i < totalStudents; i++) {
address student = listOfStudents[i];
if(reviewCount[student] != 4) {
revert HH__IncompleteReviews(student);
}
}
​
// ...rest of function...

}

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.