Dria

Swan
NFTHardhat
21,000 USDC
View results
Submission Details
Severity: high
Valid

Underflow Problem

Summary

In the LLMOracleCoordinator::finalizeValidation function, there is a potential for the function to revert under specific conditions during score calculations. This function is triggered when the final validator completes validation for a request. It iterates over all generators and assigns scores to them based on validator scores. However, there are two lines of code where a reverse can occur:

if ((score >= _mean - _stddev) && (score <= _mean + _stddev))
if (generationScores[g_i] >= mean - generationDeviationFactor * stddev)

Vulnerability Details

In scenarios such as:

  1. Four responders and four validators are present.

  2. For the first responder, validator scores are [1, 1, 5, 100].

  3. Here, the mean is 26, and the standard deviation is 48.

  4. The condition score >= _mean - _stddev will fail, causing the code to revert.

Impact

This reversion causes the function to fail due to potential underflow or overflow. Request can't be finalized and this will lead to wasted efforts by generators and validators will be. And all the fees will be stuck in the contract.

Tools Used

Manual Review

Recommendations

Make the following code adjustments to handle cases where _mean is less than _stddev:

for (uint256 v_i = 0; v_i < task.parameters.numValidations; ++v_i) {
uint256 score = scores[v_i];
+ if (_mean > _stddev) {
if ((score >= _mean - _stddev) && (score <= _mean + _stddev)) {
innerSum += score;
innerCount++;
// Send validation fee to the validator
_increaseAllowance(validations[taskId][v_i].validator, task.validatorFee);
}
+ } else {
+ if (score <= _mean + _stddev) {
+ innerSum += score;
+ innerCount++;
+ // Send validation fee to the validator
+ _increaseAllowance(validations[taskId][v_i].validator, task.validatorFee);
+ }
}
}

Apply a similar fix to handle the condition if (generationScores[g_i] >= mean - generationDeviationFactor * stddev).

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in `LLMOracleCoordinator::validate`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.