Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Review Count Increment Allows Unlimited Student Reviews

willubedaone

Summary

The LevelOne contract’s giveReview function fails to increment the review count for students after each review. As a result, students can receive more than the intended four weekly reviews, undermining graduation requirements and enabling inconsistent or unintended state transitions.

Vulnerability Details

The contract aims to enforce that each student can receive only one review per week, with a total of four reviews over the session. However, the review count is never updated after a review is given, making the guard check ineffective:

function giveReview(address _student, bool review) public onlyTeacher {
if (!isStudent[_student]) {
revert HH__StudentDoesNotExist();
}
require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
if (!review) {
studentScore[_student] -= 10;
}
​
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);
}
​

Impact

  • Students can be reviewed more than four times.

  • Graduation checks relying on completed reviews can be bypassed or produce incorrect results.

  • Undermines fairness and predictability of the upgrade process.

Proof of Concept

require(reviewCount[_student] < 5, "Student review count exceeded!!!");
// Missing: reviewCount[_student]++;

Because reviewCount[_student] is never incremented, the check will always pass. This allows unlimited reviews per student, contrary to the intended business rule that limits each student to one review per week, for a total of four.

Tools Used

Manual code review

Recommendations

Add the missing increment:

Updates

Lead Judging Commences

yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.