Block Hash Oracle Spoofing
Summary
require(
block_header.hash == IBlockHashOracle(ScrvusdVerifierV1.BLOCK_HASH_ORACLE).get_block_hash(block_header.number),
"Blockhash mismatch"
);
The contract fully trusts the
BlockHashOracleto provide a valid block hash.If an attacker controls or compromises the oracle, they can provide a fake block hash, leading to incorrect verification.
Potential Exploit
Malicious entity controls the
BlockHashOracle.They return a fake block hash and an incorrect state root.
Fake state proof then passes verification, leading to incorrect updates to
profit_max_unlock_time.
Vulnerability Details
Impact
Tools Used
Recommendations
Use multiple sources for blockhash validation (e.g., Chainlink’s decentralized data feeds).
Implement on-chain cryptographic verification using Merkle proofs from a reliable source.
Lead Judging Commences
[invalid] finding-block-number-no-input-check
- Anything related to the output by the `BLOCK_HASH_ORACLE` is OOS per \[docs here]\(<https://github.com/CodeHawks-Contests/2025-03-curve?tab=readme-ov-file#blockhash-oracle>). - The PoC utilizes a mock `BLOCK_HASH_ORACLE`which is not representative of the one used by the protocol - Even when block hash returned is incorrect, the assumption is already explicitly made known in the docs, and the contract allows a subsequent update within the same block to update and correct prices - All state roots and proofs must be verified by the OOS `StateProofVerifier` inherited as `Verifier`, so there is no proof that manipulating block timestamp/block number/inputs can affect a price update - There seems to be a lot of confusion on the block hash check. The block hash check is a unique identifier of a block and has nothing to do with the state root. All value verifications is performed by the OOS Verifier contract as mentioned above
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.