Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Persistent Session State After Graduation will prevent a new session from starting

invcbull

Summary

The graduateAndUpgrade function fails to reset inSession to false after graduation, allowing the old contract to remain in an active session state and potentially affecting the upgraded contract.

Vulnerability Details

Root Cause: In LevelOne.sol, the session state is not reset during graduation:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ...existing code...
_authorizeUpgrade(_levelTwo);
// Missing: inSession = false;
usdc.safeTransfer(principal, principalPay);
}

Initial State:

  • School in session (inSession = true)

  • Ready for graduation

  • Session end time reached

Attack Flow:

  1. Principal calls graduateAndUpgrade

  2. Contract upgrades to LevelTwo

  3. inSession remains true

  4. New contract inherits active session state

  5. Could interfere with new contract's session management

Impact

  • Session state persists incorrectly after upgrade

  • New contract starts with invalid session state

  • Could prevent new session from starting

  • Breaks session management logic

  • Could affect student enrollments and reviews in new contract


Tools Used

Tools Used

Manual review

Recommendations

Add session state reset in graduation function:

function graduateAndUpgrade(address _levelTwo, bytes memory data) public onlyPrincipal {
// ...existing code...
_authorizeUpgrade(_levelTwo);
// Reset session state
inSession = false;
// Process payments
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

session state not updated

`inSession` not updated after during upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.