Submission Details
Severity:
setStakeAmounts Lacks Input Validation Allowing Zero Stake
Summary
The setStakeAmounts function in LLMOracleRegistry lacks input validation, allowing stake amounts to be set to zero.
This could severely compromise the protocol's security by allowing oracles to register without any meaningful stake.
Vulnerability Details
Current implementation allows any value including zero:
function setStakeAmounts(uint256 _generatorStakeAmount, uint256 _validatorStakeAmount) public onlyOwner {
generatorStakeAmount = _generatorStakeAmount; // Can be set to 0
validatorStakeAmount = _validatorStakeAmount; // Can be set to 0
}
This affects the registration process:
function register(LLMOracleKind kind) public {
uint256 amount = getStakeAmount(kind);
// If amount is 0, only basic checks are needed
if (token.allowance(msg.sender, address(this)) < amount) {
revert InsufficientFunds();
}
token.transferFrom(msg.sender, address(this), amount); // Transfers 0 tokens
registrations[msg.sender][kind] = amount; // Registers with 0 stake
emit Registered(msg.sender, kind);
}
Impact
No economic stake required for oracles
Tools Used
Manual Review
Recommendations
Add minimum stake requirements:
contract LLMOracleRegistry {
uint256 public constant MIN_GENERATOR_STAKE = 1000 ether; // Example value
uint256 public constant MIN_VALIDATOR_STAKE = 500 ether; // Example value
error StakeTooLow(uint256 provided, uint256 minimum);
function setStakeAmounts(uint256 _generatorStakeAmount, uint256 _validatorStakeAmount)
public
onlyOwner
{
if (_generatorStakeAmount < MIN_GENERATOR_STAKE) {
revert StakeTooLow(_generatorStakeAmount, MIN_GENERATOR_STAKE);
}
if (_validatorStakeAmount < MIN_VALIDATOR_STAKE) {
revert StakeTooLow(_validatorStakeAmount, MIN_VALIDATOR_STAKE);
}
generatorStakeAmount = _generatorStakeAmount;
validatorStakeAmount = _validatorStakeAmount;
emit StakeAmountsUpdated(_generatorStakeAmount, _validatorStakeAmount);
}
}
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.