Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Underflow in `variance` lead to broken functionality of LLMCoordinator and protocol at all

Sickurity

Summary

Consider the Variance and Mean functions in Statistics.sol

function avg(uint256[] memory data) internal pure returns (uint256 ans) {
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
sum += data[i];
}
ans = sum / data.length;
}
​
/// @notice Compute the variance of the data.
/// @param data The data to compute the variance for.
function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean;
sum += diff * diff;
}
ans = sum / data.length;
}

You can see that data[i] - mean is taken as uint256 diff in line 15 of the variance function, which will obviously lead to underflow in 99.99% of cases, because not every value of data[i] will be greater than mean. On the contrary, only if all values in the list are the same - data[i] >= mean.

In all other cases this function will lead to underflow.

Vulnerability Details

The variance function is called inside the stddev function, which in turn is called in LLMOracleCoordinator::finaliseValidation. So 99.99% of validations will not be finalised because of revert due to underflow, which means oracle will not be able to generate a final response for 99.99% of the taskId. This means that buyerAgent queries will not be finalised either.

In general, the whole protocol logic breaks down.

Impact

Breakdown of the logic of the entire protocol 99.99% of the time. Severity: High

Tools Used

Manual Review

Recommendations

Add check, is data[i] > or < mean. If > => diff = data[i] - mean, else diff = mean - data[i]

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in computing variance

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.