Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Hardcoded scrvusd address will break multi chain implemetation

merklemore

Summary

Contracts are to be deployed accross multiple chains, but uses an hardcoded addresses.

Vulnerability Details

In ScrvusdVerifierV1,SCRVUSD is hardcoded. But the address is only valid on Ethereum mainnet.

// Common constants
> address constant SCRVUSD = 0x0655977FEb2f289A4aB78af67BAB0d17aAb84367;
bytes32 constant SCRVUSD_HASH = keccak256(abi.encodePacked(SCRVUSD));

According to the readme, the contracts are to be deployed on various EVMs, so upon contract deployment to other chains, SCRVUSD address will be incorrect breaking integration.

Compatibilities:
Blockchains:
- Any EVM, including solutions like neon on Solana
Tokens:
- scrvUSD

Impact

Integrations will break, and contract will be unusable. This is due to the use of the hash in _extractParametersFromProof and _extractPeriodFromProof in ScrvusdVerifierV1.sol and ScrvusdVerifierV2.sol respectively.

Tools Used

Manual Review

Recommendations

Consider passing the argument into the constructor instead, so it can be updated on a per chain basis.

Updates

Lead Judging Commences

0xnevi Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-hardcoded-srCRV-multi-chain

- Original scrvUSD exists only on mainnet – that's where it gets revenue. And these storage proofs are retrieved from Ethereum scrvUSD contract, meaning no other token deployment needed. - The point of using storage proofs is to port data from Ethereum to other networks. And storage proofs are just making it possible in a trustless manner wrt blockhash oracle.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.