Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

security: DinEmission.fundGI lets anyone use up a model's emission schedule on far-future GIs

Abierto
  • ¿Algo no está bien?
#238 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
solidity
Área
blockchain, security

Línea de trabajo

Read foundry/src/DinEmission.sol around fundGI and _advanceEpoch, then foundry/src/DINTaskAuditor.sol around depositRewards and the coordinator’s startGI check. The issue lists three possible fixes; first compare how each preserves permissionless funding while preventing far-future GIs from advancing the schedule. Add regression tests for far-future rejection, normal funding and the 1,000-call exhaustion case.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

DinEmission.fundGI(gi, taskAuditor) is permissionless, and it accepts any gi. The only bound is DINTaskAuditor.depositRewards's check that gi >= coordinator.GI(). The decay schedule advances once per call, not per real GI, so anyone can use up a registered model's entire emission schedule by funding GIs that will never run. Real GIs then get nothing from emission.

This is the follow-up to the PR No. 234 review (finding No. 3). It existed before that PR. #226's fix limits which auditor can be funded, not which GI.

Where

foundry/src/DinEmission.sol:

  • fundGI (:212): checks the zero address, registry membership, disabled model and the funded-GI flag, then EmissionExhausted (:224). Nothing relates gi to the model's actual progress.
  • _advanceEpoch (:295): increments gisInCurrentEpoch on every successful fundGI and moves to the next, decayed epoch after epochLength calls.

foundry/src/DINTaskAuditor.sol:

  • depositRewards (:481): if (gi == 0 || gi < dintaskcoordinatorContract.GI()) revert TA_InvalidRewardGI();. This sets a lower bound only.

Impact

  • Any address calls fundGI(1e12 + i, auditor) for i < epochLength × maxEpochs. With the deploy defaults (EMISSION_EPOCH_LENGTH=100, EMISSION_MAX_EPOCHS=10) that is 1,000 calls, gas only.
  • Afterwards fundGI(realGI, auditor) reverts EmissionExhausted. The model's whole subsidy sits in giRewardPool[1e12 + i] for GIs that will never start.
  • Nothing is stolen: the DIN stays in the model's own auditor. This is griefing, not theft. It still permanently removes the protocol subsidy for that model and inflates totalEmitted and DIN supply with tokens nobody can reach.
  • A smaller version needs no far-future GIs: funding the next N real GIs early front-loads the undecayed epochs. That is mostly harmless, since those GIs do run.

Verified during the PR No. 234 review with a scratch test on the PR head (50 calls with the test fixture's epochLength × maxEpochs). The test passes, so the griefing works today.

The NatSpec argument doesn't cover gi

fundGI's NatSpec says there's "no benefit to restricting the caller" because the amount is schedule-deterministic. That holds for the amount. It doesn't hold for gi, which the caller picks freely, and the schedule only moves forward.

Possible fixes (for discussion)

  1. Bound gi to the model's real progress. Require gi == C.GI() or gi == C.GI() + 1, where C = IDINTaskAuditor(taskAuditor).dintaskcoordinatorContract(). startGI (DINTaskCoordinator.sol:379) checks giRewardPool of the GI it is about to start, so GI() + 1 is the one that needs funding. This keeps fundGI permissionless. The new auditor call is safe because the auditor is now registry-validated (#226).
  2. Restrict the caller to the model owner, or the DIN-Representative, for that taskAuditor's model. This is simpler to reason about, but drops the "anyone can trigger the subsidy" property.
  3. Key the schedule by GI number instead of call count, so the epoch is (gi − 1) / epochLength. This removes the incentive entirely. It is a larger change to EmissionState (adds storage; keep __gap at 50 per storage_layout.md Core rules).

Option 1 looks like the smallest change. Whichever is chosen, the planned dincli model-owner rewards fund-emission <model_id> --gi N command (task_061026_21) should follow it.

Tests to add

  • An arbitrary caller's fundGI(far-future gi, registeredAuditor) reverts, and the schedule is untouched.
  • fundGI(GI() + 1, …) still succeeds, and startGI then passes TC_GIRewardPoolNotFunded.
  • The full 1,000-call exhaustion PoC (deploy defaults) as a regression test.
Lenguaje dominante
Python
Estrellas
4
Forks
7
Merge medio
3 d 4 h
PR fusionados (30 d)
34

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de InfiniteZeroFoundation/DevNet

Todos los issues de InfiniteZeroFoundation/DevNet

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.