Hawk High

Summary

The LevelOne contract's graduateAndUpgrade function fails to update the bursary variable after distributing 40% of its value to the principal and teachers. This creates a state inconsistency between the storage variable and the actual token balance, violating the invariant that "remaining 60% should reflect in the bursary after upgrade."

Vulnerability Details

When the graduateAndUpgrade function is called, it distributes funds to teachers and the principal:

However, the function never updates the bursary state variable after these transfers. This creates a discrepancy where:

1. The contract's USDC balance is reduced by the payments

2. The bursary variable still reflects the pre-payment amount (100%)

The README explicitly states that "remaining 60% should reflect in the bursary after upgrade," indicating that the bursary variable should be updated to 60% of its value after payments.

Impact

This inconsistency between the contract's state and actual token balance has several consequences:

1. State Corruption: The bursary variable doesn't accurately reflect available funds

2. Future Calculation Errors: Any future calculations based on the bursary value will be incorrect

3. Invariant Violation: The system requirement that "60% should reflect in the bursary after upgrade" is not fulfilled

4. Accounting Issues: If multiple upgrades occur, the discrepancy will compound over time

Recommendations

The bursary variable should be updated after payments to accurately reflect the remaining funds: