[CSM] Possibility to influence the report (and rewards distribution) by uploading validator keys already existing on CL. #740
Description
A Node Operator in CSM performance oracle can specify a validator key that is already active on the CL. In this scenario, the Node Operator may receive staking rewards for validators they are not actually running.
Steps to Reproduce
- Add a validator key that already exists on the CL to the CSM with a corresponding bond.
- This key must be present in the CSM module at the time of report building.
- The CSM collects duties for all keys, regardless of whether the key was deposited through the module.
- The CSM rewards tree will include rewards allocated to the NO.
How to fix:
This issue arises due to the lack of filtering by used=true when fetching data from KAPI for reward distribution calculation in the get_module_validators_by_node_operators method, as implemented in this code.