Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

security: DinEmission.fundGI lets anyone use up a model's emission schedule on far-future GIs

未关闭
  • 哪里不对？
#238 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
1-2 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
solidity
领域
blockchain, security

调研方向

Read foundry/src/DinEmission.sol around fundGI and _advanceEpoch, then foundry/src/DINTaskAuditor.sol around depositRewards and the coordinator’s startGI check. The issue lists three possible fixes; first compare how each preserves permissionless funding while preventing far-future GIs from advancing the schedule. Add regression tests for far-future rejection, normal funding and the 1,000-call exhaustion case.

由索引模型根据 Issue 内容生成。

描述

Summary

DinEmission.fundGI(gi, taskAuditor) is permissionless, and it accepts any gi. The only bound is DINTaskAuditor.depositRewards's check that gi >= coordinator.GI(). The decay schedule advances once per call, not per real GI, so anyone can use up a registered model's entire emission schedule by funding GIs that will never run. Real GIs then get nothing from emission.

This is the follow-up to the PR No. 234 review (finding No. 3). It existed before that PR. #226's fix limits which auditor can be funded, not which GI.

Where

foundry/src/DinEmission.sol:

  • fundGI (:212): checks the zero address, registry membership, disabled model and the funded-GI flag, then EmissionExhausted (:224). Nothing relates gi to the model's actual progress.
  • _advanceEpoch (:295): increments gisInCurrentEpoch on every successful fundGI and moves to the next, decayed epoch after epochLength calls.

foundry/src/DINTaskAuditor.sol:

  • depositRewards (:481): if (gi == 0 || gi < dintaskcoordinatorContract.GI()) revert TA_InvalidRewardGI();. This sets a lower bound only.

Impact

  • Any address calls fundGI(1e12 + i, auditor) for i < epochLength × maxEpochs. With the deploy defaults (EMISSION_EPOCH_LENGTH=100, EMISSION_MAX_EPOCHS=10) that is 1,000 calls, gas only.
  • Afterwards fundGI(realGI, auditor) reverts EmissionExhausted. The model's whole subsidy sits in giRewardPool[1e12 + i] for GIs that will never start.
  • Nothing is stolen: the DIN stays in the model's own auditor. This is griefing, not theft. It still permanently removes the protocol subsidy for that model and inflates totalEmitted and DIN supply with tokens nobody can reach.
  • A smaller version needs no far-future GIs: funding the next N real GIs early front-loads the undecayed epochs. That is mostly harmless, since those GIs do run.

Verified during the PR No. 234 review with a scratch test on the PR head (50 calls with the test fixture's epochLength × maxEpochs). The test passes, so the griefing works today.

The NatSpec argument doesn't cover gi

fundGI's NatSpec says there's "no benefit to restricting the caller" because the amount is schedule-deterministic. That holds for the amount. It doesn't hold for gi, which the caller picks freely, and the schedule only moves forward.

Possible fixes (for discussion)

  1. Bound gi to the model's real progress. Require gi == C.GI() or gi == C.GI() + 1, where C = IDINTaskAuditor(taskAuditor).dintaskcoordinatorContract(). startGI (DINTaskCoordinator.sol:379) checks giRewardPool of the GI it is about to start, so GI() + 1 is the one that needs funding. This keeps fundGI permissionless. The new auditor call is safe because the auditor is now registry-validated (#226).
  2. Restrict the caller to the model owner, or the DIN-Representative, for that taskAuditor's model. This is simpler to reason about, but drops the "anyone can trigger the subsidy" property.
  3. Key the schedule by GI number instead of call count, so the epoch is (gi − 1) / epochLength. This removes the incentive entirely. It is a larger change to EmissionState (adds storage; keep __gap at 50 per storage_layout.md Core rules).

Option 1 looks like the smallest change. Whichever is chosen, the planned dincli model-owner rewards fund-emission <model_id> --gi N command (task_061026_21) should follow it.

Tests to add

  • An arbitrary caller's fundGI(far-future gi, registeredAuditor) reverts, and the schedule is untouched.
  • fundGI(GI() + 1, …) still succeeds, and startGI then passes TC_GIRewardPoolNotFunded.
  • The full 1,000-call exhaustion PoC (deploy defaults) as a regression test.
主要语言
Python
星标
4
派生
7
平均合并
3 天 4 小时
30 天内合并 PR
34

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

InfiniteZeroFoundation/DevNet 的其他 Issue

查看 InfiniteZeroFoundation/DevNet 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。