Merge pull request #935 from graphprotocol/mde/pr935-fix-oz-l-01

fix: added input validation for executionThreshold (OZ L-01)
graphprotocol · Feb 20, 2024 · 9562b28 · 9562b28
2 parents 1ad7935 + fbdf6af
commit 9562b28
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol b/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol
@@ -103,6 +103,7 @@ contract SubgraphAvailabilityManager is Governed {
             _executionThreshold >= NUM_ORACLES.div(2).add(1),
             "SAM: executionThreshold too low"
         );
+        require(_executionThreshold <= NUM_ORACLES, "SAM: executionThreshold too high");
 
         // Oracles should not be address zero
         for (uint256 i = 0; i < _oracles.length; i++) {

diff --git a/packages/contracts/test/rewards/subgraphAvailability.test.ts b/packages/contracts/test/rewards/subgraphAvailability.test.ts
@@ -151,6 +151,15 @@ describe('SubgraphAvailabilityManager', () => {
         }),
       ).to.be.revertedWith('SAM: executionThreshold too low')
     })
+
+    it('should revert if executionThreshold is too high', async () => {
+      await expect(
+        deploy(DeployType.Deploy, governor, {
+          name: 'SubgraphAvailabilityManager',
+          args: [governor.address, rewardsManager.address, '6', voteTimeLimit, oracles],
+        }),
+      ).to.be.revertedWith('SAM: executionThreshold too high')
+    })
   })
 
   describe('initializer', () => {