Merge pull request #935 from graphprotocol/mde/pr935-fix-oz-l-01

fix: added input validation for executionThreshold (OZ L-01)

Author: Maikol

packages/contracts/contracts/rewards/SubgraphAvailabilityManager.sol

@@ -103,6 +103,7 @@ contract SubgraphAvailabilityManager is Governed {
             _executionThreshold >= NUM_ORACLES.div(2).add(1),
             "SAM: executionThreshold too low"
         );
+        require(_executionThreshold <= NUM_ORACLES, "SAM: executionThreshold too high");
 
         // Oracles should not be address zero
         for (uint256 i = 0; i < _oracles.length; i++) {

packages/contracts/test/rewards/subgraphAvailability.test.ts

@@ -151,6 +151,15 @@ describe('SubgraphAvailabilityManager', () => {
         }),
       ).to.be.revertedWith('SAM: executionThreshold too low')
     })
+
+    it('should revert if executionThreshold is too high', async () => {
+      await expect(
+        deploy(DeployType.Deploy, governor, {
+          name: 'SubgraphAvailabilityManager',
+          args: [governor.address, rewardsManager.address, '6', voteTimeLimit, oracles],
+        }),
+      ).to.be.revertedWith('SAM: executionThreshold too high')
+    })
   })
 
   describe('initializer', () => {