Summary

The _smoothed_price function uses a linear approximation to compute the maximum allowed price change, which inherently involves integer division and truncation of fractional components. Over multiple updates, this can lead to cumulative rounding errors that may be exploited to gradually manipulate the oracle's reported price.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-03-curve/blob/main/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L155

The function calculates the maximum change (max_change) as:

It then clamps the raw price if the difference between raw_price and last_price exceeds max_change.

Unlike exponential smoothing, which would naturally account for the time-dependent change using a multiplicative factor (i.e., last_price * e^(rate * time_delta)), the linear method truncates fractional differences. This design choice is made for simplicity but introduces unavoidable rounding errors.

When small deviations in price occur repeatedly—whether due to market conditions or attacker-induced manipulation—each update may lose a small fractional value due to truncation. Over many updates, these losses can accumulate, causing the smoothed price to diverge from the ideal value.

Impact

The cumulative error may lead to an undervalued or overvalued price relative to the actual underlying asset value. Although the error per update might be minimal, its gradual accumulation can result in significant financial discrepancies that harm liquidity providers.

Tools Used

Manual Review

Recommendations

Replace the linear approximation with an exponential model such as:

where rate is derived from max_price_increment to better capture compounding effects and reduce truncation errors.