Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Teacher Payment Distribution leading to excessive payments and potential fund drainage.

invcbull

Summary

Each teacher receives 35% of the total bursary instead of sharing the 35% among all teachers, leading to excessive payments and potential fund drainage.

Vulnerability Details

Root Cause: In LevelOne.sol, the graduateAndUpgrade function incorrectly calculates teacher payments:

​
function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
​
// ...existing code...
​
uint256 payPerTeacher = (bursary * TEACHER\_WAGE) / PRECISION;
​
for (uint256 n = 0; n < totalTeachers; n++) {
​
usdc.safeTransfer(listOfTeachers\[n], payPerTeacher);
​
}
​
// ...existing code...
​
}

Initial State:

  • Multiple teachers registered

  • Bursary funds collected from students

  • Ready for graduation

Attack Flow:

  1. Multiple teachers are added to the system

  2. Each teacher receives 35% of total bursary

  3. With just 3 teachers, 105% of bursary is paid out

  4. Contract can be drained beyond available funds

Impact

  • Protocol pays out more than available funds

  • Contract can become insolvent

  • Teachers receive incorrect compensation

  • Breaks core economic model of the protocol

Tools Used

Manual review

Recommendations

Modify the payment calculation to divide the total teacher allocation by the number of teachers:

​
​
function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
​
// ...existing code...
​
uint256 totalTeacherPayment = (bursary * TEACHER_WAGE) / PRECISION;
​
uint256 payPerTeacher = totalTeacherPayment / totalTeachers;
​
​
for (uint256 n = 0; n < totalTeachers; n++) {
​
usdc.safeTransfer(listOfTeachers\[n], payPerTeacher);
​
}
​
// ...existing code...
​
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect teacher pay calculation

`payPerTeacher` in `graduateAndUpgrade()` is incorrectly calculated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!