Storage Proofs

Summary:

Hi,

I have found out a potential bug in the contract 'ScrvusdOracleV2.vy' in which the profit unlocking logic is not calculated in correct way because of it's assumptions for parameters full_profit_unlock_date and profit_unlocking_rate.

Vulnerability Details:

The key details for this potential vulnerability can be given as follows:

The _unlocked_shares function calculates the no. of shares based on profit_unlocking_rate and time elapsed. But the logic assumes that full_profit_unlock_date is always set correctly and profit_unlocking_rate is non-zero when unlocking is in progress. And the function doesn't handle where ts (timestamp) is less than last_profit_update, which could happen if parameters are updated with an incorrect timestamp.

Impact:

• If full_profit_unlock_date is set to past timestamp or profit_unlocking_rate is zero, the contract may assumes all shares are unlocked, leading to inflated price calculations.

• If in case of ts < last_profit_update, the calculation ts - last_profit_update will underflow, causing the contract to revert or produce incorrect results.

Tools Used:

Manual Code Analysis

Recommendations:

• Add explicit checks in _unlocked_shares to ensure ts >= last_profit_update and handle edge cases for full_profit_unlock_date and profit_unlocking_rate.

• Validate full_profit_unlock_date and profit_unlocking_rate in the update_price function to ensure they are consistent with the vault’s state (e.g., full_profit_unlock_date should not be in the past unless all shares are unlocked).