Submission Details
Severity:
validationDeviationFactor is not being enforced like generationDeviationFactor
Summary
validationDeviationFactor is not being enforced like generationDeviationFactor
Vulnerability Details
Here are variables and their purpose
/// @notice The deviation factor for the validation scores.
uint64 public validationDeviationFactor;
/// @notice The deviation factor for the generation scores.
uint64 public generationDeviationFactor;
Here, we can see that only accurate responder are being awarded based on generationDeviationFactor
for (uint256 g_i = 0; g_i < task.parameters.numGenerations; g_i++) {
// ignore lower outliers
if (generationScores[g_i] >= mean - generationDeviationFactor * stddev) {
_increaseAllowance(responses[taskId][g_i].responder, task.generatorFee);
}
}
But, validationDeviationFactor is not being enforced anywhere in project which will lead to incorrect validator being awarded.
Impact
incorrect validator being awarded.
Tools Used
Recommendations
Seems liks code should look like this
for (uint256 v_i = 0; v_i < task.parameters.numValidations; ++v_i) {
uint256 score = scores[v_i];
if ((score >= _mean - _stddev) && (score <= _mean + _stddev)) {
innerSum += score;
innerCount++;
// send validation fee to the validator
+ if (score + validationDeviationFactor * stddev >= mean ) {
_increaseAllowance(validations[taskId][v_i].validator, task.validatorFee);
+ }
}
}
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.