Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Storage Slot Hardcoding

albert

Summary

Verifier contracts hardcode storage slots for scrvUSD parameters, risking failure if the original contract's storage layout changes.

Vulnerability Details

ScrvusdVerifierV1.sol uses fixed slots (e.g., total_debt at slot 21). If scrvUSD upgrades and modifies storage layout, proofs will extract incorrect values.

Impact

Oracle returns invalid prices, enabling pool manipulation or LP losses.

Tools Used

Manual review

Recommendations

Dynamically compute slots using keccak256 hashing:

uint256 constant TOTAL_DEBT_SLOT = uint256(keccak256("total_debt")) - 1; // Adjust for Vyper's 1-based slotting
Updates

Lead Judging Commences

0xnevi Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

[invalid] finding-upgradeable-verifier-contracts

Invalid, - srCRVUSD is a minimal proxy, meaning it can never by upgraded, see [here](https://www.cyfrin.io/blog/upgradeable-proxy-smart-contract-pattern#:~:text=Minimal%20proxies%20are%20distinct%20from,provide%20upgrade%20or%20authorization%20functionality.) and [here](https://www.rareskills.io/post/eip-1167-minimal-proxy-standard-with-initialization-clone-pattern) for more info. - Even if srcrvUSD is migrated in the future via a new minimal proxy contract deployment (which is highly unlikely), the verifier contracts can be migrated along with it via revoking the access-control within the `ScrvusdOracleV2.vy` and then granting access to a new oracle. This is also not within the scope of this contest.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.