Dria

Vulnerability Details

Anyone can register as a generator or validator by staking tokens, even without intending to operate as a genuine oracle node.

With the oracle parameters limiting the number of generations and validations to 10 at deployment, a malicious actor can exploit this by registering multiple wallets as generators and validators.

These addresses, not functioning as legitimate oracle nodes and without a slashing mechanism to penalize misconduct, can quickly respond to pending generations or validations, thereby farming fees. Additionally, fake validators can further disrupt the system by submitting incorrect scores that are close in range but still differ from legitimate scores. This distorts the mean and standard deviation used in fee distribution, resulting in genuine validators being deprived of their rightful earnings.

Impact

1. The generated results for requests will be compromised.

2. Legitimate generators and validators may be denied their fees, reducing the effectiveness and reliability of the oracle system.

Tools Used

Manual Review

Recommendations

1. Enforce a whitelist for node registration to ensure only trusted addresses can participate.

2. Introduce a slashing mechanism to penalize and deter malicious activity.