Description

The oracle is designed to limit price changes to 0.5 bps per block to prevent MEV and manipulation. However, this limit is not explicitly enforced in the contract, leaving room for arbitrage opportunities.

Affected Code

https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L158-L168

Vulnerability Details

The _smoothed_price function uses a linear approximation to limit price changes, but it does not enforce a hard cap on the maximum allowable price change per block. This could allow the price to change more rapidly than intended, especially during periods of high volatility. Rapid price changes create arbitrage opportunities, where attackers can front-run transactions to profit from discrepancies between the smoothed price and the actual price. This would result in losses for liquidity providers and undermine the stability of the protocol. Additionally, the lack of enforcement of the 0.5 bps per block limit increases the risk of price manipulation, as attackers could exploit the oracle's inability to handle extreme price movements.

Tools Used

Manual Review

Recommended Mitigation Steps

Enforce the 0.5 bps per block limit in the contract by capping the maximum allowable price change per block. Add a mechanism to revert transactions that exceed this limit.