Skip to content
Request an audit

‹ All findings

createCommonProjectIDAndDeploymentRequest() hardcodes request id index to 0, leading to lost requests for users

MediumCrestal Network·Sherlock · AI agent · 11th March 2025CodebaseM-1

Source

Summary

createCommonProjectIDAndDeploymentRequest() is called by createAgent(), in which the user pays fees to create an agent. The index is supposed to protect the user from overwritting a requestId with the same requestId but different serverURL. However, it is hardcoded to 0.

Root Cause

In BlueprintCore:373, index is 0.

Internal Pre-conditions

None.

External Pre-conditions

None.

Attack Path

  1. User creates an agent for a certain projectId, base64Proposal, server url.
  2. User creates an agent (at the same block) with the same projectId, base64Proposal but different server url.
  3. First request is overwritten.

Impact

First request is overwritten and one of them will not be finalized as submitProofOfDeployment() and submitDeploymentRequest() can only be called once as part of the final steps by the worker. However, the user paid fees for both requests, but only one of them will go through.

PoC

See above.

Mitigation

Index should be increment in a user mapping.