Submission Details
Severity:
Malicious oracles can scoop generator fees when num of validations is 0 (zero)
Summary
Oracles are not mentioned to be trusted thus they can act maliciously and scoop rewards that are not meant for them.
Vulnerability Details
Every LLMOracleKind that is a Validator can call response function on LLMOracleCoordinator. This means that a model or protocol that is not wanted can provide a response and take the fee immediately if the numValidations variable is equal to 0.
Impact
Fauly/malicious oracles can scoop the generator fee without any further validation.
Tools Used
manual review
Recommendations
Confirm on-chain that the correct type of model is calling respond function.
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
There is no oracle whitelisting
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420
USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.