Storage Proofs

Summary

The ScrvusdOracleV2.vy Oracle uses a single last_block_number variable for both price parameters and unlock time updates, which could lead to validation issues.

Vulnerability Details

The contract uses the same state variable to track updates from two different sources:

If two different verification sources (price and unlock time) use different block heights, this can lead to inconsistencies.

If two updates occur in the same block (e.g., price update at block N and unlock time update at block N), the later update could overwrite the earlier one.

If updates are staggered, stale data from older blocks could bypass validation (e.g., a delayed unlock time update with an older block number).

Impact

This could potentially allow out-of-order updates or block legitimate updates if different parameters are updated at different frequencies.

Tools Used

Manual Review

Recommendations

Use separate block number tracking for each type of update:

And update the validation logic accordingly in each function.