Dria

Summary

The withdrawPlatformFees() function in LLMOracleCoordinator allows the owner to withdraw all funds from the contract, including generator and validator fees that are meant to be claimed by the respective service providers.

Vulnerability Details

The withdrawPlatformFees() function transfers the entire contract balance to the owner without distinguishing between platform fees and fees reserved for generators and validators:

The issue arises because:

When tasks are created, the total fees (platform, generator, and validator fees) are transferred to the contract:

Fees for generators and validators are held in the contract until task completion:

The owner can call withdrawPlatformFees() at any time and take all funds, including those reserved for pending payments.

Example scenario:

Impact

Generators can lose earned fees for completed work

Validators can lose earned fees for validation services

Direct loss of funds meant for service providers

Tools Used

Manual Review

Recommendations

Track platform fees in a separate variable (e.g., platformFeeBalance) and update it exclusively when platform fees are collected.

Modify withdrawPlatformFees to transfer only the platformFeeBalance, leaving generatorFee and validatorFee balances unaffected. This would ensure that only platform fees are accessible to the owner.

Implementing these changes would prevent the contract from unintentionally transferring responder and validator funds, ensuring accurate reward distribution.