Submission Details
Severity:
Improper implementation of variance will cause attempts to call LLMOracleCoordinator::finalizeValidation to fail
Summary
The LLMOracleCoordinator::finalizeValidation makes use of the Statistics library which doesnt properly evaluate variance
Vulnerability Details
function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean; //@audit data[i] can be less than mean which would cause a revert,
sum += diff * diff;
}
ans = sum / data.length;
}
function stddev(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
(uint256 _variance, uint256 _mean) = variance(data);
mean = _mean;
ans = sqrt(_variance);
}
function finalizeValidation(uint256 taskId) private {
TaskRequest storage task = requests[taskId];
// compute score for each generation
for (uint256 g_i = 0; g_i < task.parameters.numGenerations; g_i++) {
// get the scores for this generation, i.e. the g_i-th element of each validation
uint256[] memory scores = new uint256[]();
for (uint256 v_i = 0; v_i < task.parameters.numValidations; v_i++) {
scores[v_i] = validations[taskId][v_i].scores[g_i];
}
// get the scores given to this generator from each validator
// compute the mean and standard deviation
(uint256 _stddev, uint256 _mean) = Statistics.stddev(scores); //@audit
As seen above finalizeValidation uses the stddev function which uses the variance function
the variance function will revert when all the scores are not the same as there will always be at least one value < mean, this causes a revert in solidity > 0.8
Impact
it will be impossible to finalize validations
Tools Used
manual analysis
Recommendations
here is a corrected version generated via chatgpt
function variance(uint256[] memory data) internal pure returns (uint256 ans, uint256 mean) {
mean = avg(data);
uint256 sum = 0;
for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] > mean ? data[i] - mean : mean - data[i];
sum += diff * diff;
}
ans = sum / data.length;
}
Updates
Lead Judging Commences
inallhonesty 8 months ago
Submission Judgement Published Assigned finding tags:
Underflow in computing variance
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.