Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Zero Stake Amount Configuration Enables Free Oracle Registration

cheatc0d33

Summary

The contract allows setting stake amounts (generatorStakeAmount, validatorStakeAmount) to zero without validation in both setStakeAmounts and initialization. This oversight enables free oracle registration if amounts are misconfigured, bypassing the economic security model of the system and potentially allowing unlimited spam registrations without any stake-based accountability.

Current Implementation:

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/llm/LLMOracleRegistry.sol#L135
https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/llm/LLMOracleRegistry.sol#L94

function setStakeAmounts(uint256 _generatorStakeAmount, uint256 _validatorStakeAmount) public onlyOwner {
generatorStakeAmount = _generatorStakeAmount;
validatorStakeAmount = _validatorStakeAmount;
}
​
function register(LLMOracleKind kind) public {
uint256 amount = getStakeAmount(kind);
token.transferFrom(msg.sender, address(this), amount);
}

The contract doesn't validate that stake amounts are greater than zero when being set by the owner. This means:

  1. Owner could accidentally set stakes to zero

  2. Allows registration with zero tokens

  3. No validation in initialization either

Impact

  • Free oracle registration possible if amounts are zero

  • Compromises the economic security model

  • Could lead to spam registrations

  • No stake-based accountability

Fix

error InvalidStakeAmount();
​
function setStakeAmounts(
uint256 _generatorStakeAmount,
uint256 _validatorStakeAmount
) public onlyOwner {
if(_generatorStakeAmount == 0 || _validatorStakeAmount == 0)
revert InvalidStakeAmount();
generatorStakeAmount = _generatorStakeAmount;
validatorStakeAmount = _validatorStakeAmount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.