# Malicious Reputer cause emissions/msgserver/InsertBulkReputerPayload to fail

A malicious reputer submits an oversized CombinedValue that overflows decimal multiplication in CalcNetworkLosses, reverting InsertBulkReputerPayload and denying other reputers' rewards.

- Payout: Contest reward
- Severity: high
- Program: Allora
- Credited: LZ_security
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/112
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-14
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:go technique:source-review vuln:business-logic vuln:dos vuln:reward-distribution

**Target:** Cosmos SDK msgserver InsertBulkReputerPayload / inference_synthesis.CalcNetworkLosses
**Root cause:** RunningWeightedAvgUpdate multiplies nextValue by nextWeight without bounds-checking; a huge CombinedValue overflows unit128 and returns an error, aborting the whole batch aggregation.
**Steps:**
1. Craft a ReputerValueBundle with CombinedValue set to `1e99999` (MustNewDecFromString) alongside normal bundles from other reputers.
2. Submit via `MsgInsertBulkReputerPayload` with the current ReputerRequestNonce/WorkerNonce.
3. InsertBulkReputerPayload calls synth.CalcNetworkLosses -> RunningWeightedAvgUpdate; `nextValue.Mul(nextWeight)` returns 'decimal multiplication error: exponent out of range'.
4. The whole call reverts; the nonce is consumed so the same payload can never be resubmitted, losing those reputers' rewards.
**How found:** Code review of the aggregation path InsertBulkReputerPayload -> CalcNetworkLosses -> RunningWeightedAvgUpdate, noticing the unchecked Mul of attacker-controlled nextValue by nextWeight; confirmed with a Go unit test passing `1e99999`.
**Exploitation:** Any reputer (open, untrusted role) submits a bundle with an astronomically large CombinedValue in the same batch as honest reputers. The aggregation step fails, the transaction reverts, and since the nonce is block-height-derived and single-use, the honest payloads for that block are permanently lost and never applied to weight/reward calculation.
**Escalation:** Attacker repeats each block at zero cost to perpetually deny reputer rewards and weight updates.
**Insight:** In batch aggregation loops, one attacker-controlled element that errors aborts the entire batch; look for arithmetic (Mul/Add on decimals) on per-submitter values inside shared aggregation and check whether a single bad input can revert the whole nonce-bound submission.