fix: require fisherman deposit for conflicting query disputes (TRST-M07)

Signed-off-by: Tomás Migone <[email protected]>

Author: tmigone

packages/subgraph-service/contracts/DisputeManager.sol

@@ -59,6 +59,9 @@ contract DisputeManager is
     // Maximum value for fisherman reward cut in PPM
     uint32 public constant MAX_FISHERMAN_REWARD_CUT = 500000;
 
+    // Minimum value for dispute deposit
+    uint256 public constant MIN_DISPUTE_DEPOSIT = 1e18; // 1 GRT
+
     // -- Modifiers --
 
     /**
@@ -174,10 +177,14 @@ contract DisputeManager is
      * @notice Create query disputes for two conflicting attestations.
      * A conflicting attestation is a proof presented by two different indexers
      * where for the same request on a subgraph the response is different.
-     * For this type of dispute the fisherman is not required to present a deposit
-     * as one of the attestation is considered to be right.
+     * For this type of dispute it's safe to assume one of the attestations is incorrect
+     * so the fisherman's deposit would not be necesarry, however to prevent spam attacks
+     * we still require it.
      * Two linked disputes will be created and if the arbitrator resolve one, the other
      * one will be automatically resolved.
+     * Requirements:
+     * - fisherman must have previously approved this contract to pull `disputeDeposit` amount
+     *   of tokens from their balance.
      * @param attestationData1 First attestation data submitted
      * @param attestationData2 Second attestation data submitted
      * @return DisputeId1, DisputeId2
@@ -205,10 +212,23 @@ contract DisputeManager is
             )
         );
 
+        // Get funds from fisherman
+        _pullFishermanDeposit();
+
         // Create the disputes
         // The deposit is zero for conflicting attestations
-        bytes32 dId1 = _createQueryDisputeWithAttestation(fisherman, 0, attestation1, attestationData1);
-        bytes32 dId2 = _createQueryDisputeWithAttestation(fisherman, 0, attestation2, attestationData2);
+        bytes32 dId1 = _createQueryDisputeWithAttestation(
+            fisherman,
+            disputeDeposit / 2,
+            attestation1,
+            attestationData1
+        );
+        bytes32 dId2 = _createQueryDisputeWithAttestation(
+            fisherman,
+            disputeDeposit / 2,
+            attestation2,
+            attestationData2
+        );
 
         // Store the linked disputes to be resolved
         disputes[dId1].relatedDisputeId = dId2;
@@ -658,7 +678,7 @@ contract DisputeManager is
      * @param _disputeDeposit The dispute deposit in Graph Tokens
      */
     function _setDisputeDeposit(uint256 _disputeDeposit) private {
-        require(_disputeDeposit != 0, DisputeManagerInvalidDisputeDeposit(_disputeDeposit));
+        require(_disputeDeposit >= MIN_DISPUTE_DEPOSIT, DisputeManagerInvalidDisputeDeposit(_disputeDeposit));
         disputeDeposit = _disputeDeposit;
         emit DisputeDepositSet(_disputeDeposit);
     }