Storage Proofs

Summary

The scrvUSDOracle smart contract includes an update_price() function that plays a critical role in maintaining up-to-date pricing information for a stablecoin protocol. However, this function contains a potentially expensive loop, which can iterate up to 192 times. Under specific conditions, this leads to gas griefing vulnerabilities, where the execution cost becomes excessively high, potentially rendering price updates unaffordable or infeasible. This scenario can disrupt the protocol's ability to update prices reliably, leaving the system vulnerable to stale pricing data and Denial of Service (DoS) threats.

Vulnerability Details

In the _obtain_price_params() function, called during update_price(), there is a loop used to compute the compounding gain from profits over several periods:

The loop runs for number_of_periods, which is capped by MAX_V2_DURATION. MAX_V2_DURATION is set to 4 * 12 * 4 (192 periods). This design means the function could execute 192 iterations in a single transaction.

Impact

High gas costs may discourage users from calling update_price(). Without timely updates, prices will stale, leading to incorrect oracle data. Smart contracts and DeFi applications relying on this oracle could malfunction, potentially locking user funds or mispricing assets.

Tools Used

Manual Review

Recommendations

Lower the upper bound for periods (currently set to 192). Evaluate whether the same functionality can be achieved with fewer periods or a different model.