Storage Proofs

Summary

The ScrvusdVerifierV1 contract does not enforce a minimum block confirmation delay for Ethereum blocks used in proofs. As a result, the system might fetch data from unfinalized Ethereum blocks .

Vulnerability details

The function verifyPeriodByBlockHash fetches state proof data directly from Ethereum without checking if the block has reached finality.
Ethereum blocks can be reorged, meaning the verifier might extract data from a block that later gets replaced.
Chains with faster finality (e.g., BSC, Avalanche) could incorporate unfinalized Ethereum block data causing inconsistencies in oracle updates.

https://github.com/CodeHawks-Contests/2025-03-curve/blob/198820f0c30d5080f75073243677ff716429dbfd/contracts/scrvusd/verifiers/ScrvusdVerifierV1.sol#L54

Impact

Blockchains with different finality guarantees may store outdated or incorrect price information incase of reorgs.

Tools Used

Manual code review

Recommendations

Enforce a finality requirement before accepting Ethereum block data.