Storage Proofs

Summary

The ScrvusdVerifierV2 contract relies entirely on an external oracle (IBlockHashOracle) to verify state roots when extracting data from proofs. If this oracle is compromised or manipulated, an attacker could submit falsified proofs, leading to incorrect updates of critical protocol parameters.

Vulnerability Details

Affected Functions:

• verifyPeriodByBlockHash

• verifyPeriodByStateRoot

Issue Description:

Both functions use IBlockHashOracle.get_state_root(_block_number) and IBlockHashOracle.get_block_hash(block_header.number) to verify proof authenticity. However, no additional verification exists to validate whether the returned state root is correct. If the oracle is compromised, an attacker can provide an incorrect state root, making the contract process invalid data.

Code References:

Impact

• Funds at risk: If manipulated state roots allow forged proof submissions, financial parameters like profit_max_unlock_time can be arbitrarily modified.

• Protocol Disruption: Incorrect parameter updates could disrupt user balances, liquidity functions, and overall financial integrity of the protocol.

• Loss of Trust: If an attacker exploits this issue, users may lose confidence in the security of the protocol.

Tools Used

• Manual code review

• Static analysis of state root verification logic

Recommendations

1. Add Secondary Validation: Implement an additional verification mechanism to ensure state root correctness before accepting proofs.

2. Decentralize Oracle Inputs: Use multiple oracles for consensus-based state root verification rather than relying on a single oracle.

3. Implement Emergency Fallbacks: Add an emergency function that can disable state root-based updates if an anomaly is detected.