Summary

The `LLMOracleCoordinator::finalizeValidation function' - for the evaluation list, mean and stddev = sqrt(variance) is calculated for each generation.

Next, select only the values that are in (mean - stddev;mean + stddev)

If you write mean and stddev formula and try to solve the inequality where stddev >= mean, then this will only work in case of mean <= 0

In normal calculations this is only possible when all the elements of the list are equal to 0. However, in solidity this state can also be achieved by rounding down when dividing.

Thus, in a particular edge case (below I will show which ones) it is possible for stddev to be more than mean.
Thus, in these edge case, the finalize validation function will not work.

This breaks the work of both LLMOracleCoordinator and BuyerAgent which is based on a completed LLM response to purchase assets. If this response is not completed, BuyerAgent will be broken.

Vulnerability Details

Consider a specific example where stddev > mean. As I said, we need mean = 0.

Consider the array of estimates [0,0,1,2].
Mean = 3 / 4 = 0.

However, stddev = sqrt(variance) = sqrt((2 2 + 1 2) / 4) = 1.

For estimates where mean = 0, but there are non-zero values and the sum of their squares is longer than the whole array of estimates - finaliteValidation will be terminated due to underflow.

The array of such ratings can be achieved by accident or deliberately, if malicious validators give incorrect ratings, but ratings that break behavior.

Impact

This vulnerability in the protocol allows a malicious DoS validator BuyerAgent.

Severity: Medium

Additionaly this issue is found at the very end of the function finalizeValidation

Additionaly this issue is found at the very end of the function finalizeValidation. Only now the average is subtracted from stddev *generationDeviationFactor. (Initial value = 1, but may change).

In this moment the probability of underflow is even higher

Tools Used

Manual Review and Math Knowledge

Recommendations

Add check before mean - sttdev.