Dria

Summary
https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleRegistry.sol#L146

The isRegistered modifier above is used to check if an oracle has tokens staked in the registry, and the minimum tokens required to be staked are defined using the generatorStakeAmount and validatorStakeAmount variables. Meaning an oracle must stake a defined minimum amount before it can be registered as a valid oracle. The issue here however is that the minimum stake amounts can be changed by the contract owner probably due to an increase in the cost of responding to request, in this scenario, oracles who have registered prior will still be considered as valid oracles and will pass the isRegistered check and will still be allowed to respond to requests and earn oracle fees but with a stake amount lower than the defined amount.

Impact

Oracles with insufficient stake amounts are still able to respond to requests and earn fees

Tools Used

Manual Review

Recommendations

In the isRegistered modifier, check if the registrations[user][kind] is greater than or equal to the required stake amount of the oracle kind, also add a method to increase oracle stakes in the event that required stake amounts are altered.