Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Hardcoded Oracle Address Creates Inflexibility Risk

maze

1. Summary

  • Severity: Low

  • Category: System Design / Configuration

  • Impact: System inflexibility and potential failure if oracle address changes

  • Likelihood: Low - requires oracle contract redeployment

2. Affected Code

address constant SCRVUSD = 0x0655977FEb2f289A4aB78af67BAB0d17aAb84367;
bytes32 constant SCRVUSD_HASH = keccak256(abi.encodePacked(SCRVUSD));

  • Contract: ScrvusdVerifierV1

  • Variables: SCRVUSD, SCRVUSD_HASH

  • Lines: 26-27

3. Vulnerability Details

Root Cause

  • Oracle address hardcoded as constant

  • Hash pre-computed at compile time

  • No mechanism to update if oracle changes

Attack Scenario

  1. Oracle contract needs redeployment due to:

    • Discovered vulnerability

    • Protocol upgrade

    • Network migration

  2. New oracle deployed at different address

  3. Verifier contract becomes unusable

  4. Entire system requires redeployment

4. Proof of Concept (PoC)

contract ScrvusdVerifierTest is Test {
function testOracleRedeployment() public {
// Deploy new oracle at different address
ScrvusdOracle newOracle = new ScrvusdOracle();
// Old verifier still points to old address
assertNotEq(ScrvusdVerifierV1.SCRVUSD, address(newOracle));
// System becomes unusable with new oracle
vm.expectRevert();
verifier.verifyScrvusdByBlockHash(validRlp, validProof);
}
}

5. Recommended Fix

Proposed Solution

contract ScrvusdVerifierV1 {
address public immutable SCRVUSD;
bytes32 public immutable SCRVUSD_HASH;
constructor(address _scrvusd) {
require(_scrvusd != address(0), "Zero address");
SCRVUSD = _scrvusd;
SCRVUSD_HASH = keccak256(abi.encodePacked(_scrvusd));
}
}

Alternative Mitigation Strategies

  • Use proxy pattern for oracle upgrades

  • Implement oracle address registry

  • Add emergency pause functionality

6. Severity Justification

  • Impact: Medium

    • Requires complete system redeployment

    • No fund loss risk

    • Recovery possible through redeployment

  • Likelihood: Low

    • Oracle address changes are rare

    • Changes are planned events

    • Testing would catch issues

Updates

Lead Judging Commences

0xnevi Lead Judge
3 months ago
0xnevi Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.