Open sherlock-admin2 opened 4 months ago
1 comment(s) were left on this issue during the judging contest.
0xmystery commented:
Error is not handled
The protocol team fixed this issue in the following PRs/commits: https://github.com/allora-network/allora-chain/pull/458
0x416
Medium
Lack of error handling when making blockless api call
Summary
Lack of error handling when making blockless api call
Vulnerability Detail
Error handling when making blockless api call is missing.
Impact
In topics_handler.go, we are calling PrepareProposalHandler
these two function requestTopicWorkers and requestTopicReputers trigger blockless api calls
for example,
the requestTopicReputers => go generateInferencesRequest => makeApiCall
the api call can fail for many reason, and if it fails, the code only log the error and does not return the error and bubble the error up for error handling.
then it means that the loss and inference request is never set out and updated,
the PrepareProposalHandler will still sliently assume the call always success and go through,
this leads to loss and inference data severely out of scope.
Code Snippet
https://github.com/sherlock-audit/2024-06-allora/blob/4e1bc73db32873476f8b0a88945815d3978d931c/allora-chain/app/app.go#L263
https://github.com/sherlock-audit/2024-06-allora/blob/4e1bc73db32873476f8b0a88945815d3978d931c/allora-chain/app/topics_handler.go#L152
https://github.com/sherlock-audit/2024-06-allora/blob/4e1bc73db32873476f8b0a88945815d3978d931c/allora-chain/app/topics_handler.go#L77
https://github.com/sherlock-audit/2024-06-allora/blob/4e1bc73db32873476f8b0a88945815d3978d931c/allora-chain/app/api.go#L160
https://github.com/sherlock-audit/2024-06-allora/blob/4e1bc73db32873476f8b0a88945815d3978d931c/allora-chain/app/api.go#L166
Tool used
Manual Review
Recommendation
handle the error from api call