Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing SessionEnd Check in graduateAndUpgrade Function Allows Premature Execution

sekkiat

Summary

The graduateAndUpgrade function is supposed to handle the distribution of payments and system upgrades at the end of a session. However, it does not include a check on sessionEnd, which allows the principal to call the function before the session ends.

Vulnerability Details

Based on the invariant: "System upgrade cannot take place unless the school’s sessionEnd has been reached.", the function graduateAndUpgrade is supposed to only execute after the school’s session has ended, However, there is no condition or modifier in the function to validate that the session has actually ended before proceeding with the upgrade. As a result, it can bypasses the lifecycle control and could lead to inconsistent or incorrect system states, including improperly timed rewards and upgrades.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// Missing sesssionEnd check here.
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}

Impact

The system can be upgraded and payments can be distributed before the session has actually ended, breaking the intended flow of operations

Tools Used

Manual Review

Recommendations

Ensure the function only executes after the session has officially ended.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
require(block.timestamp >= sessionEnd, "Session has not ended yet"); // FIX: Check if session has ended
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.