Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Access Control in ScrvusdVerifierV1 and V2

0xsubham

Summary:

The ScrvusdVerifierV1 and ScrvusdVerifierV2 contracts lack access control on their external functions—specifically verifyScrvusdByBlockHash and verifyScrvusdByStateRoot in ScrvusdVerifierV1, and verifyPeriodByBlockHash and verifyPeriodByStateRoot in ScrvusdVerifierV2—allowing anyone to call them and process state proofs, which are then forwarded to ScrvusdOracleV2. While the oracle enforces role-based restrictions (PRICE_PARAMETERS_VERIFIER and UNLOCK_TIME_VERIFIER), the verifiers remain susceptible to spam and denial-of-service (DoS) attacks due to unrestricted access. This could lead to increased gas costs and potential delays for legitimate updates.

Vulnerability Details:

Affected Contracts and Functions:

ScrvusdVerifierV1

function verifyScrvusdByBlockHash(
bytes memory _block_header_rlp,
bytes memory _proof_rlp
) external returns (uint256);
​
function verifyScrvusdByStateRoot(
uint256 _block_number,
bytes memory _proof_rlp
) external returns (uint256);

ScrvusdVerifierV2

function verifyPeriodByBlockHash(
bytes memory _block_header_rlp,
bytes memory _proof_rlp
) external returns (bool);
​
function verifyPeriodByStateRoot(
uint256 _block_number,
bytes memory _proof_rlp
) external returns (bool);

  • ScrvusdVerifierV1: verifyScrvusdByBlockHash, verifyScrvusdByStateRoot.

  • ScrvusdVerifierV2: verifyPeriodByBlockHash, verifyPeriodByStateRoot.

  • Issue: These external functions have no access restrictions, allowing any address to trigger proof processing and call.

Impact:

  • Unrestricted calls to verifiers can consume gas via RLP parsing and external oracle calls.

  • Attackers can repeatedly call the verifier functions with large or malformed proofs, consuming significant gas

Tools Used:

Manual Testing

Recommendations:

Restrict function calls to authorized roles.

Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-verify-functions-lack-access-control

Invalid, all state roots and proofs must be verified by the OOS `StateProofVerifier` inherited as `Verifier`, so there is no proof that a permisionless `verify`functions allow updating malicious prices

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.