Dria

Summary

User could not specify max amount of fee, which will be transfer to coordinator, when user make request to oracle. Fee could be changed, while user's tx in mempool.

Vulnerability Details

When user call oracleStateRequest() or oraclePurchaseRequest() in his buyer agent contract, contract LLMOracleCoordinator.sol transfer feeToken's from buyerAgent's balance. Amount of transfer depends on swan.getOracleParameters().

getOracleParams function return these data

These values could be changed by owner of project while user's tx in mempool.

Also, tx consist of platformFee, which value also could be changed, while user's tx in mempool.

Platform fee could be changed by owner of project call to LLMOracleManager.sol.setFees()

The problem is that BuyerAgent contract has infinity approve for coordinator contract. So, user could not cotrol amount, which will be transfered from his buyer agent contract.

Impact

User could not cotrol amount, which will be transfered from his buyer agent contract. Fee could changed to too big for user and if he know about new value of fee, he will not make request to oracle.

Tools Used

Manual review

Recommendations

Add parameter in oracleStateRequest() or oraclePurchaseRequest() - maxAmountFee