Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

No Boolean was returned for verifyPeriodByStateRoot( function making it difficult to distinguish between a successful update and a failure.

astrotimi

Summary

The function verifyPeriodByStateRoot is expected to return a bool indicating success or failure. However, the return value is directly tied to the result of IScrvusdOracleV2(SCRVUSD_ORACLE).update_profit_max_unlock_time(period, _block_number).

LOC

https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/verifiers/ScrvusdVerifierV2.sol#L43

Vulnerability Details

If update_profit_max_unlock_time fails (e.g., reverts due to an internal error or invalid input), the entire function will revert, and no bool will be returned. This means the function cannot return false; it will either return true or revert.

Impact

The function does not properly handle failure cases, making it difficult to distinguish between a successful update and a failure.

Tools Used

Manual Review

Recommendations

Wrap the call to update_profit_max_unlock_time in a try-catch block to handle reverts gracefully and return false in case of failure.

function verifyPeriodByStateRoot(
uint256 _block_number,
bytes memory _proof_rlp
) external returns (bool) {
bytes32 state_root = IBlockHashOracle(ScrvusdVerifierV1.BLOCK_HASH_ORACLE).get_state_root(_block_number);
uint256 period = _extractPeriodFromProof(state_root, _proof_rlp);
​
try IScrvusdOracleV2(SCRVUSD_ORACLE).update_profit_max_unlock_time(period, _block_number) {
return true; // Success
} catch {
return false; // Failure
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge
6 months ago
0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] finding-verifyPeriodByStateRoot-return-value

Non-acceptable severity, given there is arguably no impact here. If the verification function reverts, then the block number must have been outdated, which aligns with preventing updating of the max unlock time. The `verifyScrvusdByStateRoot` is unused with regard to in-scope contract context, so there is no evidence a boolean return variable is compulsory

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.