Storage Proofs

Summary

After the contracts' deployment, users can call the Verifiers functions to update the oracle's price or profit max unlock time with any valid past _block_number with its proof and set the scrvUSD price or profit_max_unlock_time to a value that is not accurate at the moment but it was in the past.

Vulnerability Details

The update_price(...) and update_profit_max_unlock_time(...) functions in ScrvusdOracleV2.vy only check that the new _block_number is greater or equal to the last_block_number:

The last_block_number value doesn't get initialized anywhere, meaning that after contract deployment it is equal to 0.

That means that users can call verifyScrvusdByBlockHash(...) and verifyScrvusdByStateRoot(...) in the ScrvusdVerifierV1 contract or verifyPeriodByBlockHash(...) and verifyPeriodByStateRoot(...) in the ScrvusdVerifierV2 contract with a block number greater than 0 as long as the user has valid Merkle Patricia proofs for the scrvUSD vault's storage slots for that block.

Impact

Attackers can backrun the contracts deployment or frontrun the first price/period update and set the price/period values to values of the past.

POC

Let's follow this scenario for an attack example:

• The ScrvusdOracleV2 and verifiers are deployed

• Attacker creates a stableswap-ng pool that uses this oracle for scrvUSD

• The attacker calls verifyScrvusdByStateRoot or verifyScrvusdByBlockHash with their chosen block

• Attacker contributes significant liquidity to that pool

  1. If an attacker manipulates the oracle to report a LOW price for scrvUSD:

     • When adding liquidity, they can contribute LESS scrvUSD per unit of other tokens

     • The pool treats this smaller amount as "fair" based on the manipulated price

     • They essentially underpay in scrvUSD for their LP position

  2. After some time the oracle will report a HIGHER/VALID price for scrvUSD and more LPs join in:

     • When removing liquidity, they receive MORE of the non-scrvUSD tokens

     • Since the pool thinks scrvUSD is worth more, it gives more of the other tokens to maintain "balance"

     • They essentially extract extra value from the pool

Tools Used

Manual review

Recommendations

Initialize the last_block_number as the current block.number.