Title

Incorrect MAX_V2_DURATION and max_v2_duration Calculation Leads to Price Calculation Errors

Summary

The constants MAX_V2_DURATION and max_v2_duration in the ScrvusdOracle contract are incorrectly calculated, resulting in deviations from the intended durations. This miscalculation causes incorrect price and parameter updates when the price update occurs within the error range of max_v2_duration.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-03-curve/blob/main/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L57

https://github.com/CodeHawks-Contests/2025-03-curve/blob/main/contracts/scrvusd/oracles/ScrvusdOracleV2.vy#L99

Below are the respective definitions of MAX_V2_DURATION constant and max_v2_duration variable:

They are intended to represent specific durations in weeks (4 years and half a year, respectively). However, the calculations incorrectly assume that every month consists of exactly 4 weeks, resulting in the following errors:

• MAX_V2_DURATION is 16 weeks short of the intended 4-year duration.

• The default value of max_v2_duration is 2 weeks short of half a year.

Further explaination:

• Incorrect MAX_V2_DURATION: A year has 52 weeks, so 4 years should be 52 * 4 = 208 weeks. However, the calculation 4 * 12 * 4 incorrectly assumes 48 weeks instead of 52, leading to a 16-week shortfall.

• Incorrect max_v2_duration: Half a year should be 26 weeks, but the current calculation results in 24 weeks, causing a 2-week discrepancy.

Impact

This occurs discrepencies in several cases including:

• Incorrect price calculations when price updates occur within the error range of max_v2_duration

• Inaccurate parameter values, which propagate to functions relying on _obtain_price_params function

Recommendations

Make the following updates to let them represent correct durations:

For MAX_V2_DURATION:

For max_v2_duration: