Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Task request may be bricked due to possible underflow revert in the variance function

danzero

Summary

The variancefunction in Statistics.solmay revert due to underflow which can prevent task request from being finalized and LLM oracle validator from receiving their rewards.

Vulnerability Details

The variancefunction in Statistics.solsubtracts each data by the mean of the data. It's likely that there will be a case when there is a data smaller than the mean of the data. When that happened, it causes underflow and revert the function.

Impact

The variancefunction is used by stddevfunction which is used in the finalizeValidationfunction which is used to finalize validation of a task request. If the variancefunction reverts this will prevent a task request from being finalized. This in turn, causes LLM oracle validator to not receive rewards for the validation they have done. Furthermore, the task requester cannot tell which is the best response of the task request. Ultimately, this prevents purchase of an asset by a buyer agent that relies on that task.

POC

Below is a snippet of the variancefunction:

function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean;
sum += diff * diff;
}
ans = sum / data.length;
}

Consider this scenario:

data = [1, 5, 8, 12]

mean = ( 1+5+8+12​ ) / 4 = 6.5 -> 6 (Due to rounding down in Solidity)

As seen above, there is a number where it is smaller than the mean (1 and 5). Hence, when this array of data is used in the variancefunction, it will try to subtract this number with the mean and it will revert due to underflow.

Tools Used

Manual review

Recommendations

Handle the case if the data is smaller than the mean:

function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] > mean ? data[i] - mean : mean - data[i];
sum += diff * diff;
}
ans = sum / data.length;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in computing variance

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.