Dria

Summary

The owner of the LLMOracleCoordinator contract is unable to withdraw funds partially, leading to a potential risk of prematurely withdrawing funds allocated for other users.

Vulnerability Details

In the LLMOracleCoordinator contract, when a user calls the request function, they transfer a totalFee to the contract. This fee consists of the platformFee, the fees for generators, and the fees for validators:

After the response and validation phases (if applicable), the generatorFee and validatorFee are sent to the generators and validators, respectively. The contract will be left with platformFee + fees from generators and validators that weren't paid.

The withdrawPlatformFees function, callable only by the owner, is designed to withdraw all remaining funds, including the platformFee. This approach presents an issue: the owner may unintentionally withdraw funds designated for generators and validators if their fees haven’t yet been distributed. Since the function doesn’t allow partial withdrawals, the owner is forced to withdraw all available funds, including those allocated to other parties.

Since request calls are frequent and generation fees and validation fees take time to be distributed, the likelihood of the owner withdrawing funds without affecting other users is very low.

Additionally, the LLMOracleCoordinator contract doesn’t directly transfer funds; it increases the allowance. If the generators and validators haven’t withdrawn their tokens, the owner may unintentionally withdraw them.

Impact

The contract’s lack of partial withdrawal functionality creates a risk where the owner may unintentionally withdraw funds owed to generators and validators. This could result in financial loss for these users.

Tools Used

Manual Review

Recommendations

• Implement a partial withdrawal mechanism that enables the owner to withdraw only the platformFee, while keeping the generator and validator fees reserved until fully distributed.

• Consider adding a status check to ensure that fees for all completed requests are distributed before allowing the owner to withdraw platform fees.