# Apply oracle update doesn’t check for duplicate validator votes

Initia's ValidateVoteExtensions summed voting power without deduplicating validators, letting a single validator forge quorum and unilaterally update oracle prices.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: 0xAlix2
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-initia-rollup-modules#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** OPinit ApplyOracleUpdate / ValidateVoteExtensions vote extension validation
**Root cause:** ValidateVoteExtensions iterates extCommit.Votes and accumulates power per entry without tracking seen validators, so repeated entries for one validator inflate sumVP past the 2/3+1 threshold.
**Steps:**
1. Observe ApplyOracleUpdate calls UpdateOracle which calls ValidateVoteExtensions on extCommit.Votes.
2. Note loop adds valStore.GetPowerByConsAddr power per vote entry with no dedup map.
3. Submit an UpdateOracle message whose extCommit.Votes repeats the same validator entry enough times to reach requiredVP.
4. Quorum check passes and oracle prices update from a single validator's votes.
**How found:** Code review of the vote validation path: noticed the loop sums power per vote entry and lacks any duplicate-validator check, unlike the quorum logic it purports to enforce.
**Exploitation:** A malicious validator (or bridge executor submitting the message) crafts an UpdateOracle with duplicated vote entries for its own consensus address, accumulating its power repeatedly until sumVP >= (2/3)+1 of totalVP, passing validation and writing attacker-chosen oracle prices.
**Insight:** When auditing quorum/threshold vote aggregation, check whether each signer is counted once; duplicate entries in a votes array are a classic way to forge supermajority from a single signer.