Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

In `LLMOracleCoordinator::finalizeValidation` when condition `score >= _mean - _stddev` and `(score <= _mean + _stddev)` are checked , `validationDeviationFactor` not multiplied in \_stddev which should be.

0x11singh99

Vulnerability Details

generationDeviationFactor and validationDeviationFactor both are defined as deviation factors.

generationDeviationFactor is used when comparing in if ( generationScores[g_i] >=mean - generationDeviationFactor * stddev)
in finalizeValidation function.

Similarly validationDeviationFactor should be used at the time of score >= _mean - _stddev and (score <= _mean + _stddev) comparing for validation but it is not used giving wrong results. And it defined nowhere it is used.

341: for (uint256 v_i = 0; v_i < task.parameters.numValidations; ++v_i) {
uint256 score = scores[v_i];
//@audit `validationDeviationFactor` is not used
if ((score >= _mean - _stddev) && (score <= _mean + _stddev)) {
innerSum += score;
innerCount++;
​
...
​
366: for (uint256 g_i = 0; g_i < task.parameters.numGenerations; g_i++) {
// ignore lower outliers
//@audit `generationDeviationFactor` is used
if (generationScores[g_i] >= mean - generationDeviationFactor * stddev) {
_increaseAllowance(responses[taskId][g_i].responder, task.generatorFee);
}
​

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/llm/LLMOracleCoordinator.sol#L343

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/llm/LLMOracleCoordinator.sol#L368

Impact

score >= _mean - _stddev and (score <= _mean + _stddev) will be wrongly compared without using validationDeviationFactor. It is nowhere used and defined for this only.

Recommendation

LLMOracleCoordinator.sol#L343

341: for (uint256 v_i = 0; v_i < task.parameters.numValidations; ++v_i) {
uint256 score = scores[v_i];
- if ((score >= _mean - _stddev) && (score <= _mean + _stddev)) {
+ if ((score >= _mean - _stddev * validationDeviationFactor) && (score <= _mean + _stddev * validationDeviationFactor)) {
innerSum += score;
innerCount++;
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.