Storage Proofs

Relevant GitHub Links

https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L334-L348

Summary

The update_profit_max_unlock_time function in ScrvusdOracleV2.vy lacks input validation, allowing the UNLOCK_TIME_VERIFIER role to drastically reduce the profit unlock time period. This can accelerate share unlocking rates by orders of magnitude, causing price calculations to become severely distorted. While the price smoothing mechanism provides some protection against sudden changes, it does not fully mitigate the economic impact of this vulnerability.

Vulnerability Details

The update_profit_max_unlock_time function allows changing a critical parameter that affects how quickly profit shares are unlocked:

The function updates profit_max_unlock_time without any minimum value constraint. This parameter is critical as it directly affects the rate at which locked shares become unlocked, which in turn affects price calculations.

The vulnerability impacts price calculation through the following code path:

1. _unlocked_shares() - calculates shares unlocked at a specific timestamp

2. _total_supply() - subtracts unlocked shares from total supply

3. _raw_price() - divides total assets by adjusted total supply

When profit_max_unlock_time is decreased, the calculation in _unlocked_shares() results in more shares being considered unlocked:

Impact

The impact of changes in the unlock time is substantial:

1. Acceleration of Share Unlocking: By changing the unlock time from the default 7 days (604,800 seconds) to a much shorter period like 1 hour (3,600 seconds), the unlocking rate would increase by approximately 168x.

2. Price Distortion: The price calculation uses total supply minus unlocked shares as the denominator. A significant reduction in this denominator leads to an inflated price.

3. Quantified Example:

   • If 1,000 locked shares are being unlocked over 7 days: normal rate ≈ 5.95 shares/hour

   • After change to 1 hour: rate ≈ 1,000 shares/hour

   • This dramatic acceleration significantly reduces the effective supply in price calculations

4. Market Consequences:

   • Stableswap pools relying on this oracle would see price distortions

   • Arbitrageurs could exploit these price differences

   • LPs would suffer impermanent loss

   • If used as collateral elsewhere, it could trigger unwarranted liquidations

While the price smoothing mechanism (via _smoothed_price function) limits immediate exploitation by capping the rate of price change, it does not prevent the economic impact from materializing over time.

Tools Used

Manual code review

Recommendations

Implement bounds checking for the profit_max_unlock_time parameter.