From fbdf6af5e6132a6c838b885ad263ec3c06ed280b Mon Sep 17 00:00:00 2001
From: Miguel de Elias <miguel.deelias@gmail.com>
Date: Thu, 1 Feb 2024 15:08:48 -0300
Subject: [PATCH] fix: added input validation for executionThreshold (OZ L-01)

---
 .../contracts/rewards/SubgraphAvailabilityManager.sol    | 1 +
 .../contracts/test/rewards/subgraphAvailability.test.ts  | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol b/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol
index 34b0ce79e..738f207df 100644
--- a/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol
+++ b/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol
@@ -103,6 +103,7 @@ contract SubgraphAvailabilityManager is Governed {
             _executionThreshold >= NUM_ORACLES.div(2).add(1),
             "SAM: executionThreshold too low"
         );
+        require(_executionThreshold <= NUM_ORACLES, "SAM: executionThreshold too high");
 
         // Oracles should not be address zero
         for (uint256 i = 0; i < _oracles.length; i++) {
diff --git a/packages/contracts/test/rewards/subgraphAvailability.test.ts b/packages/contracts/test/rewards/subgraphAvailability.test.ts
index 76276ac16..0c454dd87 100644
--- a/packages/contracts/test/rewards/subgraphAvailability.test.ts
+++ b/packages/contracts/test/rewards/subgraphAvailability.test.ts
@@ -151,6 +151,15 @@ describe('SubgraphAvailabilityManager', () => {
         }),
       ).to.be.revertedWith('SAM: executionThreshold too low')
     })
+
+    it('should revert if executionThreshold is too high', async () => {
+      await expect(
+        deploy(DeployType.Deploy, governor, {
+          name: 'SubgraphAvailabilityManager',
+          args: [governor.address, rewardsManager.address, '6', voteTimeLimit, oracles],
+        }),
+      ).to.be.revertedWith('SAM: executionThreshold too high')
+    })
   })
 
   describe('initializer', () => {