Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Division by zero in price calculations (ScrvusdOracleV2.vy)

simranjitsinghss

Summary:

Hi,

I have found out a potential bug in which the function _raw_price in the contract 'ScrvusdOracleV2.vy' is vulnerable to zero division attack.

Vulnerability Details:

The key details of this vulnerability can be given as follows:

In the _raw_price function, if self._total_supply(parameters, ts) == 0, the contract reverts due to division by zero attack. It could render the oracle unusable, if attacker with PRICE_PARAMETERS_VERIFIER role provides malicious parameters like setting total_supply = 0 or manipulating _total_supply to get 0.

@view
def _raw_price(ts: uint256, parameters_ts: uint256) -> uint256:
"""
@notice Price replication from scrvUSD vault
"""
parameters: PriceParams = self._obtain_price_params(parameters_ts)
@> return self._total_assets(parameters) * 10**18 // self._total_supply(parameters, ts)

Impact:

This vulnerability can lead to DoS attack and make it difficult for clients to use the contract.

Tools Used:

Manual Code Analysis.

Recommendations:

Try to make an assert statement for _total_supply for remediating this issue:

@view
def _raw_price(ts: uint256, parameters_ts: uint256) -> uint256:
parameters: PriceParams = self._obtain_price_params(parameters_ts)
total_supply: uint256 = self._total_supply(parameters, ts)
assert total_supply > 0, "Total supply is zero"
return self._total_assets(parameters) * 10**18 // total_supply
Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

[invalid] finding-division-by-zero

Note that `total_supply` and `profit_unlocking_rate` is initially set to 1 and 0 respectively when the `ScrvusdOracleV2.vy` is deployed 1. `total_supply` and `profit_unlocking_rate` is part of the price param updates within `update_price`, which must have gone through verification via the OOS `StateProofVerifier` contract, so there is no evidence that a 0 supply is allowed either via a 0 supply update or an extremely high `profit_unlocking_rate`. 2. Since price is retrieved via values retrived from the V3Vault, if there is no supply, there is arguably no price to be posted. As such, reverting is arguably the correct choice since a 0 price value is not expected from scrvUSD, which is a stable coin.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.