Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The School can Graduate and Upgrade before the sessionEnd

akshayd

Summary

LevelOne::graduateAndUpgrade can be called by the principal before even before LevelOne::sessionEnd duration which is against the Protocol Invariants

Vulnerability Details

Students must be graduated and upgraded only after the LevelOne::sessionEnd time has passed. But there is no check if LevelOne::sessionEnd is passed or not in LevelOne::graduateAndUpgrade function.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
//audit- should have a check that sessionEnd has reached
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
}

Impact

Students Graduate and Upgraded to next leveleven before the current Session has ended.

Recommendations

We should have a check that session ended or not before upgarding to next level

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
//q- should have a check that sessionEnd has reached
+ if(block.timestamp<sessionEnd){revert}
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

can graduate without session end

`graduateAndUpgrade()` can be called successfully even when the school session has not ended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.