Submission Details
Severity:
worng set of MAX_V2_DURATION
Summary
worng set of MAX_V2_DURATION
Vulnerability Details
as we can see in the ScrvusdOracleV2 contract the MAX_V2_DURATION value is set to
MAX_V2_DURATION: constant(uint256) = 4 * 12 * 4 # 4 years
this is wrong as the 4 years , the correct value should be:
MAX_V2_DURATION: constant(uint256) = 4 * 365 * 24 * 60 * 60 # 4 years
Impact
then the price calculations stop adjusting too early 192 seconds
Tools Used
manual review
Recommendations
change to
MAX_V2_DURATION: constant(uint256) = 4 * 365 * 24 * 60 * 60 # 4 years
Updates
Lead Judging Commences
0xnevi 2 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
[invalid] finding-MAX_V2_DURATION
This is simply an approximation. I don't believe there is any incorrect logic here, given as long as this duration of growth is consistently applied, there will arguably be no incorrect oracle prices here. Additionally, I highly doubt there will be a instance where 48 weeks has passed since the last update.
Prize pool breakdown
Total prize
14,723 OP
Eagles
1,472 OP
nSLOC
39437 OP / LOC
12,700
551
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.