Dria

Swan
NFTHardhat
21,000 USDC
View results
Submission Details
Severity: medium
Valid

Insufficient Control Over Oracle Unregistration in LLM Oracle Registry

Summary

The LLMOracleRegistry contract allows anyone to register as an oracle by staking a specified amount. However, the contract lacks mechanisms for the owner to unregister malicious oracles, posing a potential security risk.

Vulnerability Details

  • The contract does not provide functionality for the owner to unregister oracles, even if they are identified as malicious.

  • Malicious oracles can remain registered indefinitely, potentially disrupting operations or providing false data.

Impact

  • Malicious oracles can compromise the integrity of the oracle responses.

  • The presence of malicious oracles can lead to incorrect data being used in dependent systems.

Tools Used

Manual Code Review

Recommendations

Allow the owner to unregister oracles to mitigate the risk of malicious actors.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no oracle whitelisting

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.