Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

LLM oracle generator can spam empty response to task requests

danzero

Summary

LLM oracle generator can give empty response to task request and LLM oracle validator can validate it causing unfair rewarding system and losses of funds for users.

Vulnerability Details

In the respondfunction in LLMOracleCoordinator.solthere is no validation check of the response given by the LLM oracle generator. With this, malicious LLM oracle generator can find task with 0 parameters.numValidationsand give spam response and get allowance increase. Even the task with parameters.numValidationsgreater than 0, there could be malicious LLM validator oracle that validates this empty response working in cohort with the malicious LLM oracle generator.

Impact

Malicious LLM oracle generator could spam empty response and another malicious LLM oracle validator can validate the empty response which causes unfair rewarding system and losses of funds for users.

POC

Below is a snippet of the respondfunction:

function respond(uint256 taskId, uint256 nonce, bytes calldata output, bytes calldata metadata)
public
onlyRegistered(LLMOracleKind.Generator)
onlyAtStatus(taskId, TaskStatus.PendingGeneration)
{
TaskRequest storage task = requests[taskId];
​
// ensure responder to be unique for this task
for (uint256 i = 0; i < responses[taskId].length; i++) {
if (responses[taskId][i].responder == msg.sender) {
revert AlreadyResponded(taskId, msg.sender);
}
}
​
// check nonce (proof-of-work)
assertValidNonce(taskId, task, nonce);
​
// push response
TaskResponse memory response =
TaskResponse({responder: msg.sender, nonce: nonce, output: output, metadata: metadata, score: 0});
responses[taskId].push(response);
​
// emit response events
emit Response(taskId, msg.sender);
​
// send rewards to the generator if there is no validation
if (task.parameters.numValidations == 0) {
_increaseAllowance(msg.sender, task.generatorFee);
}
​
// check if we have received enough responses & update task status
bool isCompleted = responses[taskId].length == uint256(task.parameters.numGenerations);
if (isCompleted) {
if (task.parameters.numValidations == 0) {
// no validations required, task is completed
task.status = TaskStatus.Completed;
emit StatusUpdate(taskId, task.protocol, TaskStatus.PendingGeneration, TaskStatus.Completed);
} else {
// now we are waiting for validations
task.status = TaskStatus.PendingValidation;
emit StatusUpdate(taskId, task.protocol, TaskStatus.PendingGeneration, TaskStatus.PendingValidation);
}
}
}

Here, the outputvariable is the response by the LLM oracle generator. As seen above, the outputis never checked/validated in this function.

Tools Used

Manual review

Recommendations

Check the length of outputin the respondfunction so that empty output cannot be accepted.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incomplete checks in `respond()` of `LLMOracleCoordinator.sol`, `output` is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.