Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

ScrvusdVerifierV2 Missing access modifiers on external functions

zaa

Summary

Anyone can access the controle system

Vulnerability Details

Security vulnerability

Impact

Could lead to unauthorized state modifications

Tools Used

Manual review

Recommendations

contract StateProofVerifier {
// Add access control
address private immutable owner;
constructor() {
owner = msg.sender;
}
modifier onlyOwner() {
require(msg.sender == owner, "Not owner");
_;
}
// Add state revocation
function revokeState(bytes32 stateHash) external onlyOwner {
verifiedStates[stateHash] = false;
emit StateVerificationRevoked(stateHash);
}
}

Initialization

When the contract is deployed, the deployer becomes the owner. Initially the owner has access to protected functions.

Adding authorized users

  • The owner can add new authorized callers using addAuthorizedCaller

  • Once added, these addresses can use protected functions

Function Access

  • When someone calls a protected function (like verifyPeriodByBlockHash)

  • The onlyAuthorized modifier checks their permissions

  • If authorized, the function executes; otherwise, it reverts

This access control system provides a secure way to manage who can use the contract's verification functions while maintaining administrative control through the owner role.

**Required additions and enhances features **

// Batch verification support
function verifyStatesBatch(bytes32[] calldata hashes) external onlyOwner {
for(uint256 i = 0; i < hashes.length; i++) {
verifiedStates[hashes[i]] = true;
}
}
​
// State verification helper
function isStateVerified(bytes32 hash) public view returns(bool) {
return verifiedStates[hash];
}
mapping(bytes32 => bool) public verifiedStates;
event StateVerificationRevoked(bytes32 stateHash);
Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-verify-functions-lack-access-control

Invalid, all state roots and proofs must be verified by the OOS `StateProofVerifier` inherited as `Verifier`, so there is no proof that a permisionless `verify`functions allow updating malicious prices

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.