Dria

Summary

In the finalizeValidation function of the LLMOracleCoordinator contract, oracle fees are distributed by increasing the allowance for validators and responders rather than directly transferring the tokens to them.

This approach depends on each oracle manually calling transferFrom to retrieve their fees, which introduces unnecessary friction, increases the complexity of fund retrieval, and may lead to unclaimed or stranded funds.

Vulnerability Details

In finalizeValidation, allowances are granted to oracles as follows:

Instead of directly transferring the fees to the oracles’ addresses, the function uses _increaseAllowance, requiring each oracle to manually claim their funds using transferFrom.

This may be impractical and can lead to funds being left unclaimed if oracles do not take additional steps to retrieve them.

Additionally, if an oracle address does not implement the necessary retrieval logic, the funds could become inaccessible.

Impact

The current allowance-based approach can result in friction for oracles attempting to retrieve their fees, and there is a risk of funds remaining unclaimed.

This undermines the efficiency and user-friendliness of the reward mechanism, potentially reducing oracle participation and trust in the protocol’s incentive model.

Tools Used

Manual Review

Recommendations

Use Direct Transfers for Fee Distribution: