Dria

Summary

The withdraw() function enforces a minimum fund amount (minFundAmount) in the contract if withdrawals are initiated outside the Withdraw phase. However, changes in the minimum and maximum parameter limits in the LLMOracleManager do not immediately update the oracleParameters in the SwanManager contract, leaving a window where out-of-bounds oracleParameters could still be used.

This allows for an incorrect minFundAmount calculation, potentially letting users withdraw more than they should, especially if the parameters do not meet the new limits.

Vulnerability Details

The withdraw() function has a check to ensure the contract’s balance remains above minFundAmount unless the current phase is Withdraw.

The function minFundAmount() computes the required minimum fund amount as follows:

This depends on the result of swan.getOracleFee(), which in turn relies on oracleParameters.

The getOracleFee() function in Swan calculates the oracle fee using coordinator.getFee(oracleParameters).

Also, the protocol enforces that oracleParameters should fall within certain set bounds of min/max which can also be modified via the LLMOracleManager:setParameters()

Therefore, if the parameter limits are modified in LLMOracleManager without an immediate update of oracleParameters in SwanManager, coordinator.getFee() will still use the outdated values, which are possibly out of the newly set bounds.

Flawed getFee() Calculation:

The coordinator.getFee() function uses oracleParameters without checking if its values are within the new parameter limits.

In other parts of the codebase, the protocol relies on onlyValidParameters() modifier to perform these validations as follows:

However, the getFee() function does not use this modifier. Since parameters.difficulty, parameters.numGenerations, and parameters.numValidations are not validated, they could exceed the new limits if not immediately updated.

Impact

The time window between updating parameter limits in LLMOracleManager and updating oracleParameters in SwanManager allows outdated values, possibly out of range, to be used in calculating minFundAmount. This could result in an inaccurate minimum fund amount, allowing users to withdraw more funds than intended when the contract is not in the Withdraw phase, potentially depleting the treasury below acceptable levels.

Tools Used

Manual Review

Recommendations

Add the onlyValidParameters modifier to coordinator.getFee() to enforce parameter limits:

This ensures that parameters.difficulty, parameters.numGenerations, and parameters.numValidations are validated consistently. This way, even if the owner made changes to the limits in LLMOracleManager but has not yet updated oracleParameters in SwanManager, the newly set limits will be in effect immediately blocking any potential out-of-bounds transactions.