Hardcoded Storage Slots in Verifiers Risk Parameter Extraction Failures
Summary
The verifier contracts (ScrvusdVerifierV1.sol and ScrvusdVerifierV2.sol) rely on hardcoded storage slots to extract scrvUSD vault parameters. If the scrvUSD contract undergoes an upgrade that modifies its storage layout, the verifiers will read incorrect data, leading to inaccurate price calculations and potential disruptions in dependent systems.
Vulnerability Details
The verifiers use a fixed array of storage slots (PARAM_SLOTS) to fetch scrvUSD parameters such as total_debt, total_idle, and total_supply. For example:
If the scrvUSD contract is upgraded and its storage layout changes, the verifiers will read invalid data from the wrong slots.
Impact
Incorrect Price Updates: The oracle will provide inaccurate prices, leading to arbitrage opportunities and potential losses for liquidity providers.
System Disruption: Dependent systems (e.g., stableswap-ng pools) may fail to function correctly, causing financial losses and reputational damage.
Tools Used
Recommendations
Implement a Governance Mechanism to Update Storage Slots
Document Strict Compatibility Requirements
Add Storage Layout Validation
Use Proxy Patterns for Upgrades
Lead Judging Commences
[invalid] finding-upgradeable-verifier-contracts
Invalid, - srCRVUSD is a minimal proxy, meaning it can never by upgraded, see [here](https://www.cyfrin.io/blog/upgradeable-proxy-smart-contract-pattern#:~:text=Minimal%20proxies%20are%20distinct%20from,provide%20upgrade%20or%20authorization%20functionality.) and [here](https://www.rareskills.io/post/eip-1167-minimal-proxy-standard-with-initialization-clone-pattern) for more info. - Even if srcrvUSD is migrated in the future via a new minimal proxy contract deployment (which is highly unlikely), the verifier contracts can be migrated along with it via revoking the access-control within the `ScrvusdOracleV2.vy` and then granting access to a new oracle. This is also not within the scope of this contest.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.