Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

security: DinEmission.fundGI lets anyone use up a model's emission schedule on far-future GIs

オープン
  • 何か問題がありますか？
#238 コメント 3 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
1〜2日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
solidity
領域
blockchain, security

調査の方向性

Read foundry/src/DinEmission.sol around fundGI and _advanceEpoch, then foundry/src/DINTaskAuditor.sol around depositRewards and the coordinator’s startGI check. The issue lists three possible fixes; first compare how each preserves permissionless funding while preventing far-future GIs from advancing the schedule. Add regression tests for far-future rejection, normal funding and the 1,000-call exhaustion case.

索引モデルが issue の本文から書いたものです。

説明

Summary

DinEmission.fundGI(gi, taskAuditor) is permissionless, and it accepts any gi. The only bound is DINTaskAuditor.depositRewards's check that gi >= coordinator.GI(). The decay schedule advances once per call, not per real GI, so anyone can use up a registered model's entire emission schedule by funding GIs that will never run. Real GIs then get nothing from emission.

This is the follow-up to the PR No. 234 review (finding No. 3). It existed before that PR. #226's fix limits which auditor can be funded, not which GI.

Where

foundry/src/DinEmission.sol:

  • fundGI (:212): checks the zero address, registry membership, disabled model and the funded-GI flag, then EmissionExhausted (:224). Nothing relates gi to the model's actual progress.
  • _advanceEpoch (:295): increments gisInCurrentEpoch on every successful fundGI and moves to the next, decayed epoch after epochLength calls.

foundry/src/DINTaskAuditor.sol:

  • depositRewards (:481): if (gi == 0 || gi < dintaskcoordinatorContract.GI()) revert TA_InvalidRewardGI();. This sets a lower bound only.

Impact

  • Any address calls fundGI(1e12 + i, auditor) for i < epochLength × maxEpochs. With the deploy defaults (EMISSION_EPOCH_LENGTH=100, EMISSION_MAX_EPOCHS=10) that is 1,000 calls, gas only.
  • Afterwards fundGI(realGI, auditor) reverts EmissionExhausted. The model's whole subsidy sits in giRewardPool[1e12 + i] for GIs that will never start.
  • Nothing is stolen: the DIN stays in the model's own auditor. This is griefing, not theft. It still permanently removes the protocol subsidy for that model and inflates totalEmitted and DIN supply with tokens nobody can reach.
  • A smaller version needs no far-future GIs: funding the next N real GIs early front-loads the undecayed epochs. That is mostly harmless, since those GIs do run.

Verified during the PR No. 234 review with a scratch test on the PR head (50 calls with the test fixture's epochLength × maxEpochs). The test passes, so the griefing works today.

The NatSpec argument doesn't cover gi

fundGI's NatSpec says there's "no benefit to restricting the caller" because the amount is schedule-deterministic. That holds for the amount. It doesn't hold for gi, which the caller picks freely, and the schedule only moves forward.

Possible fixes (for discussion)

  1. Bound gi to the model's real progress. Require gi == C.GI() or gi == C.GI() + 1, where C = IDINTaskAuditor(taskAuditor).dintaskcoordinatorContract(). startGI (DINTaskCoordinator.sol:379) checks giRewardPool of the GI it is about to start, so GI() + 1 is the one that needs funding. This keeps fundGI permissionless. The new auditor call is safe because the auditor is now registry-validated (#226).
  2. Restrict the caller to the model owner, or the DIN-Representative, for that taskAuditor's model. This is simpler to reason about, but drops the "anyone can trigger the subsidy" property.
  3. Key the schedule by GI number instead of call count, so the epoch is (gi − 1) / epochLength. This removes the incentive entirely. It is a larger change to EmissionState (adds storage; keep __gap at 50 per storage_layout.md Core rules).

Option 1 looks like the smallest change. Whichever is chosen, the planned dincli model-owner rewards fund-emission <model_id> --gi N command (task_061026_21) should follow it.

Tests to add

  • An arbitrary caller's fundGI(far-future gi, registeredAuditor) reverts, and the schedule is untouched.
  • fundGI(GI() + 1, …) still succeeds, and startGI then passes TC_GIRewardPoolNotFunded.
  • The full 1,000-call exhaustion PoC (deploy defaults) as a regression test.
主要言語
Python
スター
4
フォーク
7
平均マージ
3日 58分
マージ済み PR（30日）
39

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

InfiniteZeroFoundation/DevNet のほかの issue

InfiniteZeroFoundation/DevNet の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。