Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Check for Maximum Score in the `LLMOracleCoordinator::validate` function.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L255

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L260

Summary

wrong implementation of the logic described in the documentation.

Vulnerability Details

The natspec of the LLMOracleCoordinator::validate function indicates that it should revert if any score is greater than the maximum score, but this check is not present in the implementation:

/// @notice Validate requests for a given taskId.
/// @dev Reverts if the task is not pending validation.
/// @dev Reverts if the number of scores is not equal to the number of generations.
@> /// @dev Reverts if any score is greater than the maximum score.
/// ... The rest of natspec
function validate(uint256 taskId, uint256 nonce, uint256[] calldata scores, bytes calldata metadata)
public
onlyRegistered(LLMOracleKind.Validator)
onlyAtStatus(taskId, TaskStatus.PendingValidation)
{
TaskRequest storage task = requests[taskId];
​
// ensure there is a score for each generation
if (scores.length != task.parameters.numGenerations) {
revert InvalidValidation(taskId, msg.sender);
}
// @audit missing check for max score
​
/// ... The rest of code
}

Impact

Without this check, potentially invalid scores can be processed, which could compromise the integrity of the validation process.

Tools Used

Manual analysis.

Recommendations

/// @notice Validate requests for a given taskId.
/// @dev Reverts if the task is not pending validation.
/// @dev Reverts if the number of scores is not equal to the number of generations.
@> /// @dev Reverts if any score is greater than the maximum score.
/// ... The rest of natspec
function validate(uint256 taskId, uint256 nonce, uint256[] calldata scores, bytes calldata metadata)
public
onlyRegistered(LLMOracleKind.Validator)
onlyAtStatus(taskId, TaskStatus.PendingValidation)
{
TaskRequest storage task = requests[taskId];
​
// ensure there is a score for each generation
if (scores.length != task.parameters.numGenerations) {
revert InvalidValidation(taskId, msg.sender);
}
​
// @audit ensure that each score is less than or equal to the maximum score
+ for (uint256 i = 0; i < scores.length; i++) {
+ if (scores[i] > MAX_SCORE) { // @audit Assuming MAX_SCORE and InvalidScore are defined
+ revert InvalidScore(taskId, msg.sender, scores[i]);
+ }
+ }
​
/// ... The rest of code
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unbounded score values in `validate` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.