Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

System upgrade can occurs even if some students has no review during session causing Invariant Breaks

franzops

Summary

System upgrade with function graduateAndUpgrade can occurs even if students has no reviews at the end of the 4 week of the session breaking Invariant.

Vulnerability Details

The function LevelOne::graduateAndUpgrade does not check if all students got the necessary 4 reviews at the end of the session.

This means that a session can end even if no reviews have been submitted, breaking the invariant.

Impact

VERY HIGH, it cause an important invariant break and it's likelihood is high too.

Tools Used

Manual review

Recommendations

Consider adding a check in the function LevelOne::graduateAndUpgrade which revert if it finds a student with less then 4 reviews.

Proof Of Code:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
+ for (uint256 n = 0; n < listOfStudents.length; n++) {
+ if (reviewCount[listOfStudents[n]] < 4) {
+ revert HH__NotAllowed();
+ }
+ }
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.