Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Sessions Can Be Ended Without Students Receiving Minimum Required Reviews

geekybot

Summary

The LevelOne contract allows the principal to end a session and perform graduation without ensuring that each student has received the minimum number of required reviews. This breaks the protocol invariant and severely disrupts it's operation.

Vulnerability Details

According to the contract's design, students are expected to receive multiple reviews from teachers (up to 4 reviews total as checked in the giveReview function). However, there are no checks in the endSession or graduateAndUpgrade functions to verify that students have received a minimum number of reviews before concluding the session:

This means the principal can end a session and graduate students even if some students have received 0 reviews, making the review system effectively optional despite its apparent importance in the educational process.

Impact

  • Students may not receive proper evaluation before graduation

  • Students who paid school fees are denied full evaluation services

  • Educational outcomes cannot be properly measured without adequate reviews

Tools Used

  • Manual code review

  • Business logic analysis

Proof of Concept

function test_graduation_without_minimum_reviews() public schoolInSession {
// Give a review to student1, but none to student2
vm.warp(block.timestamp + 1 weeks);
vm.prank(alice);
levelOneProxy.giveReview(clara, true);
// Fast forward close to session end
vm.warp(block.timestamp + 3 weeks + 6 days);
// Setup for graduation
levelTwoImplementation = new LevelTwo();
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
// Graduate all students despite student2 having 0 reviews
vm.prank(principal);
levelOneProxy.graduateAndUpgrade(address(levelTwoImplementation), data);
// Verify graduation succeeded despite missing reviews
LevelTwo levelTwoProxy = LevelTwo(proxyAddress);
assertTrue(levelTwoProxy.isStudent(clara));
assertTrue(levelTwoProxy.isStudent(fin), "Student with 0 reviews was graduated");
}

Recommendations

  1. Implement a minimum review requirement before allowing graduation:

function graduateAndUpgrade(
address _levelTwo,
bytes memory data
) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
// Check that all students have received minimum reviews
uint256 minimumReviews = 4; // as per protocol Invariant
for (uint256 i = 0; i < listOfStudents.length; i++) {
address student = listOfStudents[i];
require(
reviewCount[student] == minimumReviews,
"Not all students have received minimum reviews"
);
}
// Continue with graduation logic...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.