Storage Proofs

Summary

improper validation of the last_profit_update timestamp parameter

Vulnerability Details

valid_params = [

50 * 10**18, # total_debt (50)

50 * 10**18, # total_idle (50)

100 * 10**18, # total_supply (100)

initial_ts + 7*86400, # full_profit_unlock_date

0, # profit_unlocking_rate

2**256 - 1, # last_profit_update - overflow

0 # balance_of_self

]

Impact

1. Price Manipulation:

   • Underflows in time delta calculations (ts - last_profit_update)

   • Incorrect unlocked_shares leading to distorted pricePerShare

2. Protocol Insolvency Risk:

   • Artificial inflation/deflation of scrvUSD value

   • Enables draining liquidity pools through arbitrage

3. Permanent Corruption:

   • Once invalid parameters are accepted, price calculations remain broken until manual intervention

Attack Scenario:

1. Attacker submits last_profit_update = 2^256-1 (max uint256)

2. Oracle accepts this due to missing upper bound checks

3. Future calculations using ts - last_profit_update underflow (since last_profit_update > ts)

4. unlocked_shares calculation returns garbage values

Tools Used

Manual Review

Recommendations

Reality Checks