Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Arithmetic underflow in oracle score validation

mikb

Summary

A critical arithmetic underflow vulnerability exists in finalizeValidation() of the LLMOracleCoordinator contract when calculating score validation bounds. This underflow allows malicious validators to bypass score validation checks and manipulate the oracle system.

Vulnerability Details

In LLMOracleCoordinator.sol, finalizeValidation() calculates a lower bound for valid scores using mean and standard deviation:

function finalizeValidation(uint256 taskId) private {
// ...
(uint256 _stddev, uint256 _mean) = Statistics.stddev(scores);
for (uint256 v_i = 0; v_i < task.parameters.numValidations; ++v_i) {
uint256 score = scores[v_i];
if ((score >= _mean - _stddev) && (score <= _mean + _stddev)) { // underflow in _mean - _stddev
innerSum += score;
innerCount++;
_increaseAllowance(validations[taskId][v_i].validator, task.validatorFee);
}
}
// ...
}

The root cause is in _mean - _stddev. Since both values are uint256, if _stddev is greater than _mean, this will cause an underflow.

Impact

The transaction will revert.

Tools Used

Manual code review

Recommendations

Handle case where std dev exceeds mean.

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in `LLMOracleCoordinator::validate`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.