Storage Proofs

Summary

The _extractPeriodFromProof() function in ScrvusdVerifierV2.sol only verifies that slot.exists is true but does not perform any validation on slot.value. This lack of explicit validity checks could allow an attacker to manipulate the profit unlock time by submitting a crafted proof that tricks the function into accepting a manipulated period value.

Vulnerability Details

The function _extractPeriodFromProof() is responsible for extracting a period value from a state proof using a given state root. However, it only checks for the existence of the slot but does not validate the extracted value:

Here, require(slot.exists); ensures that the slot exists but does not verify if slot.value is within an expected range. If an attacker manages to submit a proof that makes slot.exists return true while setting an arbitrary slot.value, they could manipulate profit unlock times.

Impact

• An attacker could submit a manipulated proof to delay or accelerate the profit unlock time.

• This could be exploited to manipulate financial parameters in the protocol, potentially leading to unfair advantages or financial losses.

Tools Used

• Manual code review

• Static analysis tools for Solidity security

Recommendations

2.Add Range Checks: Ensure that slot.value falls within a reasonable range.

2.Verify Against Historical Data: Compare slot.value against previously stored values to detect anomalies.

3.Enhance Proof Validation: Introduce additional verification mechanisms to confirm the legitimacy of the extracted period value.