fix missing validation of scores (#32)

src/ImpactEvaluator.sol

@@ -105,6 +105,7 @@ contract ImpactEvaluator is AccessControl {
         Round storage round = rounds[roundIndex];
         require(round.exists, "Round does not exist");
         require(!round.scoresSubmitted, "Scores already submitted");
+        validateScores(scores);
         for (uint i = 0; i < addresses.length; i++) {
             round.scores[addresses[i]] = scores[i];
         }
@@ -113,6 +114,14 @@ contract ImpactEvaluator is AccessControl {
         reward(addresses, scores);
     }
 
+    function validateScores(uint64[] memory scores) pure private {
+        uint64 sum = 0;
+        for (uint i = 0; i < scores.length; i++) {
+            sum += scores[i];
+        }
+        require(sum <= 1e15, "Sum of scores too big");
+    }
+
     function reward(
         address payable[] memory addresses,
         uint64[] memory scores

test/ImpactEvaluator.t.sol

@@ -166,6 +166,19 @@ contract ImpactEvaluatorTest is Test {
         impactEvaluator.setScores(0, addresses, scores, "0 tasks performed");
     }
 
+    function test_SetScoresTooBig() public {
+        ImpactEvaluator impactEvaluator = new ImpactEvaluator(address(this));
+        impactEvaluator.adminAdvanceRound();
+
+        address payable[] memory addresses = new address payable[](1);
+        addresses[0] = payable(vm.addr(1));
+        uint64[] memory scores = new uint64[](1);
+        scores[0] = 1e15 + 1;
+        vm.deal(payable(address(impactEvaluator)), 100 ether);
+        vm.expectRevert("Sum of scores too big");
+        impactEvaluator.setScores(0, addresses, scores, "1 task performed");
+    }
+
     function test_SetScoresUnfinishedRound() public {
         ImpactEvaluator impactEvaluator = new ImpactEvaluator(address(this));
         address payable[] memory addresses = new address payable[](0);