Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Bounds Check Leading to Underflow in `_unlocked_shares`

0xrakesh_ummadi28

Summary

The _unlocked_shares function lacks a check on ts - last_profit_update, allowing underflow if ts is less than last_profit_update. This produces a large unlocked_shares value, reducing _total_supply and inflating the price in _raw_price, which feeds the stableswap-ng pool.

Vulnerability Details

Location: ScrvusdOracleV2.vy

​
if full_profit_unlock_date > ts:
unlocked_shares = profit_unlocking_rate * (ts - last_profit_update) // MAX_BPS_EXTENDED

Issue: No validation ensures ts >= last_profit_update, causing underflow in uint256 subtraction, resulting in a huge unlocked_shares.

Trigger: Future last_profit_update from update_price or _obtain_price_params.

Impact

Inflated pool price enables risking LP losses and temporary disruption. No direct problem to the funds, but affects pool.

Tools Used

  • Manual code review

Recommendations

  • Add the bounds check:

@view
def _unlocked_shares(
full_profit_unlock_date: uint256,
profit_unlocking_rate: uint256,
last_profit_update: uint256,
balance_of_self: uint256,
ts: uint256,
) -> uint256:
unlocked_shares: uint256 = 0
if full_profit_unlock_date > ts:
# If we have not fully unlocked, we need to calculate how much has been.
+ delta: uint256 = 0
+ if ts > last_profit_update:
+ delta = ts - last_profit_update
unlocked_shares = profit_unlocking_rate * (ts - last_profit_update) // MAX_BPS_EXTENDED
​
elif full_profit_unlock_date != 0:
# All shares have been unlocked
unlocked_shares = balance_of_self
​
return unlocked_shares
​
Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

[invalid] finding-timestamp-underflow

This issues and duplicates are very similar to reasonings highlighted in issue #11. The timestamp variables are extracted and verified via the OOS `StateProofVerifier` contract inherited as `Verifier`. There is simply no concrete proof that the verifier allowed such an underflow to occur, representing stale price value updates.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.