Storage Proofs

Location: ScrvusdOracleV2.vy, in the _smoothed_price function and other timestamp-dependent calculations

Vulnerable Code:

Additional Timestamp-Dependent Functions:

Description:
The oracle heavily relies on block.timestamp for critical price calculations, particularly in the _smoothed_price function which implements the price smoothing mechanism. This function calculates the maximum allowed price change based on the time elapsed since the last update (block.timestamp - self.last_update).

Root Cause:
Block timestamps in Ethereum can be manipulated by miners within certain bounds (typically up to about 15 seconds into the future). While this is a known limitation of blockchain timestamps, it becomes a vulnerability when used in financial calculations without additional safeguards.

Impact:
A malicious miner could slightly manipulate the timestamp to increase the allowed price change (max_change), potentially allowing larger price movements than intended by the smoothing mechanism. In the context of a high-value DeFi system, even small manipulations could create profitable arbitrage opportunities.

For example, if the raw price has moved significantly, a miner could increase block.timestamp to maximize the allowed price change and then execute trades that profit from this larger-than-intended price movement. While the manipulation window is limited to seconds, in volatile markets with highly leveraged positions, even small timing and price advantages can be exploited for gain.

recommendation

Implement additional safeguards against timestamp manipulation.