Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

There is no range for valid score values

emmanuel

Summary

This arises from a lack of validation on score inputs, allowing validators to submit any value, including extreme ones, to manipulate task results

Vulnerability Details

Protocol does not validate the score values inputted by the validators, to check that it falls within the acceptable range:

function validate(
uint256 taskId,
uint256 nonce,
uint256[] calldata scores,
bytes calldata metadata
) public onlyRegistered(LLMOracleKind.Validator) onlyAtStatus(taskId, TaskStatus.PendingValidation) {
TaskRequest storage task = requests[taskId];
​
// ensure there is a score for each generation
if (scores.length != task.parameters.numGenerations) {
revert InvalidValidation(taskId, msg.sender);
}
​
// ensure validator did not participate in generation
for (uint256 i = 0; i < task.parameters.numGenerations; i++) {
if (responses[taskId][i].responder == msg.sender) {
revert AlreadyResponded(taskId, msg.sender);
}
}
​
// ensure validator to be unique for this task
for (uint256 i = 0; i < validations[taskId].length; i++) {
if (validations[taskId][i].validator == msg.sender) {
revert AlreadyResponded(taskId, msg.sender);
}
}
...
}

As we can see, the scores do not get checked, to ensure they are in the acceptable range.

This allows validators to enter any uint256 value as the score, encouraging malicious validators to input absurdly high values, like 2^256-1 to significantly skew and manipulate the score values.

Impact

This allows validators to input arbitrary values for scores without range validation, which can be exploited to manipulate task outcomes. Malicious validators could enter extreme values, like 2^{256} - 1 , to artificially skew the scores and distort the task’s result, potentially favoring certain outcomes

Tools Used

Manual Review

Recommendations

If score > 1e18, revert

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unbounded score values in `validate` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.