Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

reviewCount of reviewed students is not updating

akshayd

Summary

LevelOne::reviewCount of students is not getting updated after review in LevelOne::giveReview function which can manipulate student scores

Vulnerability Details

Since a Student should be max given 4 reviews only(1 per week). But if the LevelOne::reviewCount doesn't updates after a review, there is no record of how many reviews a student is given. Hence a teacher can manipulate the student scores by giving more than 4 reviews to students and can make student scores high or low as his wish.

require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
​
//@audit reviewCount of reviewed students is not updated due to this a teacher can give multiple reviews to a student
// Update last review time
lastReviewTime[_student] = block.timestamp;
​
emit ReviewGiven(_student, review, studentScore[_student]);

Impact

A teacher can manipulate the student scores by giving more reviews than expected review numbers(i.e 4).

Recommendations

The LevelOne::reviewCount must be increased by 1 as soon as a teacher gives a review to a student.

require(reviewCount[_student] < 5, "Student review count exceeded!!!");
require(block.timestamp >= lastReviewTime[_student] + reviewTime, "Reviews can only be given once per week");
​
// where `false` is a bad review and true is a good review
if (!review) {
studentScore[_student] -= 10;
}
// Update last review time and reviewCount
lastReviewTime[_student] = block.timestamp;
+ reviewCount[_student]+=1;
emit ReviewGiven(_student, review, studentScore[_student]);
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

reviewCount not updated

`reviewCount` for students is not updated after each review session

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.