Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inadequate Validation for PriceParams in update_price Function

0xkimonic

Summary

The update_price function in ScrvusdOracleV2.vy accepts raw parameters without sufficient validation, potentially allowing invalid state updates.

Vulnerability Details

When updating price parameters, the function accepts all inputs without validating their consistency or reasonableness

@external
def update_price(
_parameters: uint256[ALL_PARAM_CNT], _ts: uint256, _block_number: uint256
) -> uint256:
# ... role check and block number check ...
self.price_params = PriceParams(
total_debt=_parameters[0],
total_idle=_parameters[1],
total_supply=_parameters[2],
full_profit_unlock_date=_parameters[3],
profit_unlocking_rate=_parameters[4],
last_profit_update=_parameters[5],
balance_of_self=_parameters[6],
)
self.price_params_ts = _ts
# ...

There are no checks to ensure:

  1. total_supply is greater than or equal to balance_of_self

  2. The timestamps (full_profit_unlock_date, last_profit_update) are reasonable

  3. total_supply is not zero (which would cause division by zero in price calculations)

Impact

Invalid parameters could lead to incorrect price calculations or unexpected reverts when calculating prices, potentially causing the oracle to malfunction.

If invalid parameters (e.g., total_supply = 0 or balance_of_self > total_supply) are set, key functions like price_v0, price_v1, or price_v2 could revert due to underflows or division by zero, causing a denial-of-service (DoS) for the oracle.

Incorrect price calculations could propagate to dependent protocols (e.g., AMM pools), leading to financial losses or manipulation.

Tools Used

Manual Review

Recommendations

  • Add parameter validation before updating the state:

assert _parameters[2] > 0, "total_supply zero" # total_supply
assert _parameters[6] <= _parameters[2], "balance_of_self exceeds supply" # balance_of_self
assert _parameters[5] <= _parameters[3], "invalid timestamps" # last_profit_update <= full_profit_unlock_date

  • Ensure total_idle + total_debt matches the vault's actual assets (off-chain checks).

Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

[invalid] finding-missing-proof-content-validation

- See [here]([https://github.com/CodeHawks-Contests/2025-03-curve?tab=readme-ov-file#blockhash-oracle)](https://github.com/CodeHawks-Contests/2025-03-curve?tab=readme-ov-file#blockhash-oracle) on how it is used to verify storage variable - All state roots and proofs must be verified by the OOS `StateProofVerifier` inherited as `Verifier` (where the price values and params are extracted), so there is no proof that manipulating timestamp/inputs can affect a price update - It is assumed that the OOS prover will provide accurate data and the OOS verifier will verify the prices/max unlock time to be within an appropriate bound/values - There is a account existance check in L96 of `ScrvusdVerifierV1.sol`, in which the params for price updates are extracted from

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.