Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Due to an issue in `statistics.sol::variance`, `LLMOracleCoordinator::finalizeValidation` function is bound to revert

0xlookman

Description

The LLMOracleCoordinator::finalizeValidation function is called to finalize validation when the required validations for a request are reached.
This function calls the Statistics::stddev to calculate the standard deviations for scores of a given generation from different validations.

An issue occurs in Statistics::stddev when it calls Statistics::variance which gets the deviation by subtracting data(scores) minus the mean. This is bound to underFlow and panic (revert with panic error) all the time since mean is of all the scores and some scores will definately be greater than the mean and the underflow occurs since the value is of type uint256.

for (uint256 i = 0; i < data.length; i++) {
uint256 diff = data[i] - mean;
sum += diff * diff;
}

  • https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/libraries/Statistics.sol#L21C8-L24C10

Impact

Denial of service and validator and Generator won't be paid their amounts.

Tools Used

Manual Review

Recommendation

consider using type int256 instead of uint256 in Statistics::variance.

for (uint256 i = 0; i < data.length; i++) {
int256 diff = data[i] - mean;
sum += diff * diff;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in computing variance

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.