withdrawPlatformFees shouldn’t be withdrawing the entire contract’s balance
Summary
The function withdrawPlatformFees of LLMOracleCoordinator is transferring the entire feeToken balance of the contract to the owner, instead of transferring the platform fees.
Vulnerability Details
The contract LLMOracleCoordinator is missing a variable that aggregates all the fees the platform has collected, in order to transfer these fees to the owner when he calls withdrawPlatformFees.
That can result in the owner mistakenly withdrawing generator and validator fees, that have not been transferred out or that have not been allocated yet.
Impact
The generators and validators that haven't transferred out their fees, will suffer losses.
Tools Used
Manual Review
Recommended Mitigation
Introduce a variable to track the platform fees, and use it in order to send the right amount of fees to the owner when withdrawPlatformFees is called.
Lead Judging Commences
`withdrawPlatformFees` withdraws the entire balance
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.