## Relevant Context The `aggregation` contract is designed to aggregate data points from multiple signers for various feeds (e.g., `ETH`, `BTC`, `AVAX`). The aggregation process involves computing the median value of the collected data points for each feed. This is implemented in the `aggregated()` function, which operates on a `Vec>`, where each inner vector contains the data points for a specific feed. ## Description In the `aggregated()` function, the contract iterates over each inner vector (`values`) representing the data points for a feed and computes its median using the `median()` function. The issue arises when a feed has no data points—meaning none of the signers have provided data for that feed. In such cases, the corresponding `values` vector is empty. ```rust impl Vec> { pub fn aggregated(self) -> Vec { let mut aggregated = Vec::new(); let mut i = 0; while (i < self.len()) { let values = self.get(i).unwrap(); aggregated.push(values.median()); i += 1; } aggregated } } ``` The root cause of the vulnerability is that the `aggregated()` function does not check if the `values` vector is empty before calling `median()`. Attempting to compute the median of an empty vector leads to a runtime panic because there are no elements to calculate the median from. ```rust impl Vec { pub fn median(self) -> u256 { match self.len() { 0 => revert(0), 1 => self.get(0).unwrap(), 2 => self.get(0).unwrap().avg_with(self.get(1).unwrap()), _ => { let mut values = self; values.sort(); let mid = values.len() / 2; if (values.len() % 2 == 1) { values.get(mid).unwrap() } else { values.get(mid).unwrap().avg_with(values.get(mid - 1).unwrap()) } } } } } ``` This unhandled scenario can cause the contract to revert unexpectedly during the aggregation process, leading to a denial of service. The highest impact occurs when the contract is configured to process multiple feeds, and at least one feed receives no data from any signer. The entire aggregation process fails due to the unhandled empty vector, affecting the contract's availability and reliability. ## Impact Explanation **High** The impact is high because this issue can cause a complete denial of service for the contract's aggregation functionality. ## Proof of Concept **Scenario:** 1. **Contract Configuration:** - The contract is set up to process data for three feeds: `ETH`, `BTC`, and `AVAX`. - The `aggregated()` function is responsible for computing the median value for each feed. 2. **Data Submission:** - Signers submit data points for `ETH` and `BTC` feeds. - No signers submit data for the `AVAX` feed, resulting in an empty `values` vector for `AVAX`. 3. **Aggregation Process:** - The `process_input()` function is called with the payload containing data for `ETH` and `BTC`. - Inside `process_input()`, the `aggregated()` function is invoked to compute the median values. 4. **Runtime Panic:** - When `aggregated()` tries to compute the median of the empty `values` vector for `AVAX`, it calls `median()` without checking if the vector is empty. - This results in a runtime panic because `median()` cannot operate on an empty vector. 5. **Contract Reversion:** - The contract unexpectedly reverts due to the unhandled panic, causing a denial of service. ## Recommendation Implement a check in the `aggregated()` function to handle empty `values` vectors properly. Two possible solutions are: 1. **Return Optional Values:** Modify the `aggregated()` function to return a `Vec>`, where it pushes `None` for feeds with no data: ```rust impl Vec> { pub fn aggregated(self) -> Vec> { let mut aggregated = Vec::new(); for values in self { if values.is_empty() { aggregated.push(None); // No data for this feed } else { aggregated.push(Some(values.median())); } } aggregated } } ``` Update any functions that use the aggregated results to handle `Option` values appropriately, ensuring that the absence of data is accounted for in the contract's logic. 2. **Revert with Specific Error:** Introduce a check to revert the transaction when an empty `values` vector is encountered, providing a clear error message: ```rust impl Vec> { pub fn aggregated(self) -> Vec { let mut aggregated = Vec::new(); for (i, values) in self.iter().enumerate() { if values.is_empty() { revert(NO_VALUES_FOR_FEED + i as u64); // Custom error code for empty feed } aggregated.push(values.median()); } aggregated } } ``` Define a new error constant `NO_VALUES_FOR_FEED` to represent the specific error case. This approach ensures that the contract does not proceed with incomplete data and provides immediate feedback about the missing feed data.

Contest	Position	Date	Payout
hyperlend	8 / 260	November 2024	$2,708
zetachain-protocol	19 / 335	August 2024	$2,163
symbioticfi-core	24 / 416	September 2024	$212

Agontuk

Top competitions