fix: added input validation for executionThreshold (OZ L-01)

graphprotocol · Feb 1, 2024 · fbdf6af · fbdf6af
1 parent 1ad7935
commit fbdf6af
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol b/packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol
@@ -103,6 +103,7 @@ contract SubgraphAvailabilityManager is Governed {
             _executionThreshold >= NUM_ORACLES.div(2).add(1),
             "SAM: executionThreshold too low"
         );
+        require(_executionThreshold <= NUM_ORACLES, "SAM: executionThreshold too high");
 
         // Oracles should not be address zero
         for (uint256 i = 0; i < _oracles.length; i++) {

diff --git a/packages/contracts/test/rewards/subgraphAvailability.test.ts b/packages/contracts/test/rewards/subgraphAvailability.test.ts
@@ -151,6 +151,15 @@ describe('SubgraphAvailabilityManager', () => {
         }),
       ).to.be.revertedWith('SAM: executionThreshold too low')
     })
+
+    it('should revert if executionThreshold is too high', async () => {
+      await expect(
+        deploy(DeployType.Deploy, governor, {
+          name: 'SubgraphAvailabilityManager',
+          args: [governor.address, rewardsManager.address, '6', voteTimeLimit, oracles],
+        }),
+      ).to.be.revertedWith('SAM: executionThreshold too high')
+    })
   })
 
   describe('initializer', () => {