Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The School can Graduate and Upgrade even if all students don't get 4 reviews

akshayd

Summary

LevelOne::graduateAndUpgrade can be called by the principal before even if each student have not been given 4 reviews which is against the Protocol Invariants

Vulnerability Details

Students must be graduated and upgraded only after if each student has been reviewed 4 time by a teacher. But there is no check if each student has 4 reviews or not in LevelOne::graduateAndUpgrade function.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
//@audit- check whether each student has beed reviewed 4 times or not,if not revert back
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
}

Impact

Students Graduate and Upgraded to next level even if they don't have proper 4 reviews which are necessary for next level.

Recommendations

We should have a check that each session has 4 reviewsCount.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
//@audit- check whether each student has beed reviewed 4 times or not,if not revert back
uint256 totalStudents = listOfStudents.length;
for(uint256 i=0; i<totalStudents; i++){
if(reviewCount[listOfStudents[i]]!=4){revert()}
}
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
usdc.safeTransfer(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 26 days ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

yeahchibyke Lead Judge 26 days ago
Submission Judgement Published
Validated
Assigned finding tags:

cut-off criteria not applied

All students are graduated when the graduation function is called as the cut-off criteria is not applied.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.