Storage Proofs

Summary

IScrvusdOracleV2(SCRVUSD_ORACLE).update_profit_max_unlock_time(period, block_header.number);

• No mechanism prevents replaying an old valid proof from a past block.

• If profit_max_unlock_time decreases, an attacker can submit an old proof to set it back.

Potential Exploit

1. Suppose in block 1000, the correct profit_max_unlock_time was 100.

2. Later, at block 2000, profit_max_unlock_time increases to 500.

3. An attacker replays the proof from block 1000, setting profit_max_unlock_time back to 100.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-03-curve/blob/main/contracts/scrvusd/verifiers/ScrvusdVerifierV2.sol#L38

Impact

Tools Used

Recommendations

Add block age constraints to prevent submitting very old proofs.

• Require a monotonically increasing profit_max_unlock_time.

• Store verified block numbers and reject proofs from lower blocks.