Storage Proofs

Summary

In ScrvUsdVerifierV1, the verifyScrvusdByStateRoot and verifyScrvusdByBlockHashfunction verifies either state root or block hash from Ethereum. However, these functions do not verify that the params passed into update_pricefunction is valid and non-zero.

Vulnerability Details

In verifyScrvusdByBlockHash:

In verifyScrvusdByStateRoot:

As seen in code snippets above, the functions internally call extractParametersFromProof--> this function first verifies that the account exists, then it extracts the slot values from the proof. When extracting the slot values, even if slots do not exist or return its value = 0, these values are still retrieved and makes up the params. Then, these same paramsare passed into updatePrice()function.

The issue here is that proof validation does not automatically guarantee the validity of the parameters. For example, it is critical if totalSupply == 0 after initialisation, and unusual if totalIdle and totalDebt == 0. The validity of these parameters should be checked before calling _updatePrice() function.

Impact

Updating of self.price_paramscould be incorrect due to lack of parameter value checks, hence easily impacting future price updates and price projections.

Tools Used

Manual

Recommendations

Set up checks for parameters that should not be 0 or extremely low/high values before passing extracted parameter values from proof into _updatePricefunction.