# Anyone can overwrite Reputer and Worker info attached to a LibP2PKey

Allora-chain's Register message never verifies LibP2PKey ownership, letting anyone overwrite reputer/worker OffchainNode records keyed by any peer's LibP2PKey.

- Payout: Contest reward
- Severity: high
- Program: Allora
- Credited: carrotsmuggler
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/111
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-13
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:go technique:source-review vuln:access-control vuln:business-logic

**Target:** Cosmos SDK chain emissions module Register msg / reputers & workers maps
**Root cause:** InsertReputer/InsertWorker call collections.Map.Set keyed by LibP2PKey without checking the caller owns that key, so an existing entry is silently overwritten.
**Steps:**
1. Call `Register` with `IsReputer=true`, `LibP2PKey` set to a victim peer's key, and arbitrary `Owner`/`MultiAddress`
2. InsertReputer writes `k.reputers[LibP2PKey] = OffchainNode{NodeAddress: msg.Sender, Owner: msg.Owner, ...}` overwriting the victim's record
3. Query `GetReputerAddressByP2PKey(victimKey)` to confirm the address now resolves to attacker-controlled data
4. Repeat with `IsReputer=false` for the worker map via InsertWorker
**How found:** Code review of the Register msg server: noticed nodeInfo is built from user-supplied LibP2PKey and passed to InsertReputer, which uses Set on a map keyed by that key with no ownership check.
**Exploitation:** Attacker registers with a victim's LibP2PKey, poisoning the on-chain mapping; allora-inference-base reads GetReputerAddressByP2PKey/GetWorkerAddressByP2PKey and routes data to the attacker's address, breaking network accounting.
**Insight:** In Cosmos modules, any collections.Map keyed by a user-supplied identifier (peer key, node id) is overwritable unless the handler proves key ownership; grep for `.Set(ctx, msg.` patterns where the key comes from the message.