Description

The set_max_price_increment function lacks validation to ensure that the maximum price increment is less than StableSwap's minimum fee. This could lead to price manipulation if the maximum price increment is set too high.

Affected Code

https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L357-L371

Vulnerability Details

The function currently only validates that _max_price_increment is between 10**8 and 10**18, which is an extremely wide range. If _max_price_increment is set too high (but still within these bounds), the oracle could allow price movements that exceed StableSwap's minimum fee threshold.

This creates a fundamental economic vulnerability in the system. When price movements exceed the StableSwap fee, arbitrageurs can profit by trading against the price discrepancy, extracting value from the protocol. The relationship between maximum price movement and swap fees is critical for protocol security.

While this issue requires admin privileges to exploit directly, it represents a significant protocol parameter risk. Even an accidental misconfiguration by a privileged user could lead to sustained value extraction by arbitrageurs, potentially depleting liquidity pools over time.

Tools Used

Manual Review

Recommended Mitigation Steps

Add validation to ensure the maximum price increment is less than StableSwap's minimum fee: