Dria

Summary

The request function in the smart contract expects a protocol string of exactly 32 bytes, as noted in the function's documentation. However, there is no validation to enforce this length. Allowing protocol inputs of any length can lead to unexpected behavior and runtime errors in parts of the contract.

Vulnerability Details

• Function: request

• Issue: Without a validation check, the protocol parameter could be set to a length other than 32 bytes, leading to potential issues in storage or downstream processing that expects a strict 32-byte format.

Location:
LLMOracleCoordinator.sol

https://github.com/Cyfrin/2024-10-swan-dria/blob/c3f6f027ed51dd31f60b224506de2bc847243eb7/contracts/llm/LLMOracleCoordinator.sol#L150

Impact

1. If the protocol string length is inconsistent, it may cause unexpected behavior in storage or processing tasks.

2. The lack of validation may lead to runtime errors in tasks or components that assume a fixed-length protocol parameter.

Tools Used

Manual review

Recommendations

Add a validation check in the request function to enforce a 32-byte length for the protocol parameter. This will ensure consistency with the expected format and prevent any downstream errors.

Suggested Mitigation

Updated function