Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The check in the `finalizeValidation` if value of mean is less than generationDeviationFactor * stddev , in certain condition.

saurabh_singh

Summary

the ( mean - generationDeviationFactor * stddev ) will revert if the value of mean is less than generationDeviationFactor * stddev.

Vulnerability Details

In the LLMOracleCoordinator::finalizevalidation the if check will revert in certain condition.

if the value of mean is less than generationDeviationFactor * stddev than it will revert.

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L368

if (generationScores[g_i] >= mean - generationDeviationFactor * stddev) {
_increaseAllowance(responses[taskId][g_i].responder, task.generatorFee);
}

Impact

the transaction will revert in certain condition cause the improper working of function.

Tools Used

manual review

Recommendations

calculate the absolute diff and store it in diff variable and then compare:-

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L368

- if (generationScores[g_i] >= mean - generationDeviationFactor * stddev) {
- _increaseAllowance(responses[taskId][g_i].responder, task.generatorFee);
- }
​
​
+uint256 threshold = mean >= generationDeviationFactor * stddev
+ ? mean - generationDeviationFactor * stddev
+ : generationDeviationFactor * stddev - mean;
+ if (generationScores[g_i] >= threshold) {
+ _increaseAllowance(responses[taskId][g_i].responder, task.generatorFee);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Underflow in `LLMOracleCoordinator::validate`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.