Storage Proofs

Summary

Having a mismatch in precision constants between the Ethereum vault and the Oracle. The Ethereum vault uses MAX_BPS = 1e18 for calculations, while the Oracle uses MAX_BPS_EXTENDED = 1e12 -> causes the Oracle to overestimate the number of unlocked shares, underrepresenting the effective total supply of scrvUSD

-> result: The price per share reported by the Oracle becomes inflated

Vulnerability Details

Inconsistent precision constants used in the calculation of unlocked_shares:

The mismatch:

• Root Cause: MAX_BPS_EXTENDED = 1e12 in the Oracle versus MAX_BPS = 1e18 on Ethereum

Code Location: ScrvusdOracleV2.vy, _obtain_price_params() function:

Uses MAX_BPS_EXTENDED = 1e12 (12 decimal precision):

Example:

Ethereum Vault:

• Uses MAX_BPS = 1e18 (18 decimal precision).

• Calculates profit_unlocking_rate as:

  solidity

  profit_unlocking_rate = (locked_shares * MAX_BPS) / profit_max_unlock_time

• Example:

  • locked_shares = 1e18 (1 token with 18 decimals).

  • profit_max_unlock_time = 604800 (7 days in seconds).

  • profit_unlocking_rate = (1e18 * 1e18) / 604800 ≈ 1.653e15.

Oracle Contract (ScrvusdOracleV2.vy):

• Uses MAX_BPS_EXTENDED = 1e12 (12 decimal precision).

• Calculates unlocked_shares as:

  vyper

  unlocked_shares = profit_unlocking_rate * (ts - last_profit_update) // MAX_BPS_EXTENDED

• Using the example:

  • ts - last_profit_update = 604800 (full unlock period).

  • unlocked_shares = (1.653e15 * 604800) // 1e12 ≈ 1e21.

• Correct calculation (if aligned with MAX_BPS = 1e18):

  • unlocked_shares = (1.653e15 * 604800) // 1e18 ≈ 1e18

-> Result: The Oracle overestimates unlocked_shares by a factor of 1e6 (since 1e18 / 1e12 = 1e6).

link:

• https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L207

• https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L55

Effect: unlocked_shares is 1e6 times larger, understating total_supply_effective and inflating the price.

Link:

• https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L216-L225

• https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L285-L291

Impact

Overstated unlocked_shares reduces the effective total supply.

Price Inflation: The Oracle reports an artificially high price for scrvUSD due to the understated effective total supply.

Tools Used

Recommendations

Align Constants: Set MAX_BPS_EXTENDED = 1e18 in the Oracle to match Ethereum.

Or alternative: Scale profit_unlocking_rate down by 1e6 when fetched, but aligning constants is cleaner.