# Not appropriate Inferences will be used when calculating the forecast

Allora's forecast verification builds a filtered acceptedForecastElements slice but never assigns it back, so unaccepted inferers' forecasts are used in reward/forecast calculation.

- Payout: Contest reward
- Severity: high
- Program: Allora
- Credited: volodya
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/14
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:go technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Cosmos SDK chain msg server (keeper/msgserver/msg_server_worker_payload.go)
**Root cause:** acceptedForecastElements is constructed by filtering forecast.ForecastElements against acceptedInferersOfBatch, but the filtered slice is never written back to forecast.ForecastElements, so the original unfiltered elements persist.
**Steps:**
1. Read verifyAndInsertForecastsFromTopForecasters in keeper/msgserver/msg_server_worker_payload.go#L163
2. Observe acceptedForecastElements is built by appending only elements whose Inferer is in acceptedInferersOfBatch
3. Note the slice is never assigned to forecast.ForecastElements before forecastsByForecaster[forecast.Forecaster] = forecast
4. Submit a forecast referencing inferers not in the accepted batch; it is retained and used in forecast calculation
**How found:** Code reading of the filtering loop: noticed acceptedForecastElements was populated but never used to overwrite forecast.ForecastElements, contradicting the comment's stated intent.
**Exploitation:** A forecaster submits forecast elements referencing inferers that were not accepted in the current batch; because the filtered slice is discarded, those invalid elements remain in the stored forecast and influence forecast/reward computation.
**Insight:** When reviewing filter loops, verify the filtered result is actually written back to the object being stored; a populated local slice that is never assigned is a silent no-op filter.