Storage Proofs

Summary

There has been found a vulnerability in raw_price function from ScrvusdOracleV2.vy contract.

It accepts two timestamp parameters _ts and _parameters_ts, both defaulting to block.timestamp.
This means that by default, both timestamps represent the current block timestamp when no arguments are provided.

While this might appear reasonable at first glance, using block.timestamp as the default value for these parameters introduces a potential timing issue, particularly because:

_ts is meant to represent the timestamp at which the price should be observed, and _parameters_ts represents the timestamp for the parameters used in the price calculation.
The default block.timestamp for both parameters may lead to inconsistent or outdated prices if these timestamps are meant to reflect different points in time. For example, prices might be calculated at a slightly earlier or later time than intended, resulting in erroneous or outdated price data being used in calculations.

Impact

• Pricing inaccuracy

• Timestamp exploit

Tools Used

Manual Review

Recommendations

Use time ranges base on the business logic stated in comments