Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Generators and validators lose their rewards in LLMOracleCoordinator.sol

merlin

Summary

Users can register as generators or validators for earning rewards for their works. These rewards, along with the platform fee, are accumulated on the LLMOracleCoordinator contract, allowing users to decide when to withdraw their rewards. However, the issue lies in the fact that the platform fee is stored within the contract, and the owner of LLMOracleCoordinator can only withdraw the entire fee token balance at once, which includes all accumulated rewards of generators and validators.

Vulnerability Details

The fee token is transferred to the LLMOracleCoordinator contract whenever a user requests LLM generation:\

// transfer tokens
feeToken.transferFrom(msg.sender, address(this), totalfee);

When a generator responds to an LLM generation or a validator validates responses, their fee token allowance increases:

// send validation fee to the validator
_increaseAllowance(validations[taskId][v_i].validator, task.validatorFee);
​
function _increaseAllowance(address spender, uint256 amount) internal {
feeToken.approve(spender, feeToken.allowance(address(this), spender) + amount);
}

Generator, validator, and platform rewards are held within the contract, creating a situation where, if the owner wishes to withdraw the platform fee, they will end up withdrawing the entire balance of fee tokens:

function withdrawPlatformFees() public onlyOwner {
feeToken.transfer(owner(), feeToken.balanceOf(address(this)));
}

Impact

The rewards for generators and validators will be withdrawn by the owner of the LLMOracleCoordinator contract, resulting in their loss.

Tools Used

Manual review

Recommendations

Consider keeping track of platform rewards and withdrawing only those amounts.

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`withdrawPlatformFees` withdraws the entire balance

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.