Storage Proofs

Summary

The ScrvusdVerifierV1::_extractParametersFromProof function doesn't check if a slot exists before using its value, silently treating non-existent slots as zero. This could lead to incorrect parameter readings and potentially significant miscalculations in price data.

Vulnerability Details

In ScrvusdVerifierV1, the _extractParametersFromProof function has this logic:

The comment "Slots might not exist, but typically we just read them" indicates that the code intentionally ignores whether the slot exists and simply uses its value, which would be 0 for non-existent slots.

In contrast, in ScrvusdVerifierV2, the _extractPeriodFromProof function checks that the slot exists:

Critical parameters like total_debt, total_idle, and total_supply should never be zero in a functioning scrvUSD vault. If a slot doesn't exist (due to an incorrect slot number or other issues), treating it as zero could lead to highly inaccurate price calculations.

Impact

The likelihood of this issue manifesting is medium but this has a quite number of impact to the protocol; It can lead to incorrect price calculations if any slot is non-existent. According to the project documentation, price inaccuracies can "lead to MEV in the liquidity pool, at a loss for the liquidity providers"

Tools Used

Manul review

Recommendations

Add existence checks for all slots and revert if any critical slot is missing, this ensures that all slots exist and that critical parameters are non-zero, preventing potential price calculation errors.