Summary

A lack of input validation in the update_price functions in ScrvusdOracleV2.vy. This issue could allow incorrect or malicious data to be processed, potentially affecting the integrity of the contract's operations.

Vulnerability Details

1. Lack of Input Validation in update_price Function

• Description: The update_price function does not properly validate the _parameters array before assigning its values to the price_params struct. This could allow invalid or manipulated values to be stored, affecting price calculations and potentially leading to incorrect share valuations.

• Affected Code:

Potential Exploits:

• An attacker could provide malformed data in _parameters, leading to incorrect total supply, debt, or profit unlocking rate.

• If the values cause an integer overflow, it could disrupt the expected behavior of the contract.

Impact

• A malicious or faulty input could cause incorrect calculations, leading to an inaccurate share price.

• This could destabilize integrations relying on the Oracle.

• Attackers may manipulate block numbers to introduce inconsistencies in price calculations.

Tools Used

Manual Review

Recommendations

• Set reasonable lower and upper bounds for the update_price

• Implement assertions or require statements to prevent extreme values from being set.

• Ensure _block_number is correctly validated to avoid outdated updates.