Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Wrong Storage Slots for `balanceOf(self)` in ScrvusdVerifierV1 contract

bladesec

Title

Wrong Storage Slots for balanceOf(self) in ScrvusdVerifierV1 contract

Summary

The ScrvusdVerifierV1 contract has the error in defining the storage slot of balanceOf(self).

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-03-curve/blob/main/contracts/scrvusd/verifiers/ScrvusdVerifierV1.sol#L40

uint256[PROOF_CNT] internal PARAM_SLOTS = [
uint256(0), // filler for account proof
uint256(21), // total_debt
uint256(22), // total_idle
uint256(20), // totalSupply
uint256(38), // full_profit_unlock_date
uint256(39), // profit_unlocking_rate
uint256(40), // last_profit_update
>> uint256(keccak256(abi.encode(18, SCRVUSD))) // balanceOf(self)
];

Above calculation(keccak256(abi.encode(18, SCRVUSD))) misinterprets the correct order of arguments, which leads to accessing wrong slot for balanceOf(self), causing the contract to read it from an unintended and incorrect location. It happened because the parameters (18 and SCRVUSD) were put in reverse order.

Impact

The verifier reads balance_of_self from an unintended storage location, leading to corrupted or invalid data. The incorrect data can propagate through the oracle, affecting price calculations and any functionality relying on the verifier.

Recommendations

Make the following update:

-- uint256(keccak256(abi.encode(18, SCRVUSD))) // balanceOf(self)
++ uint256(keccak256(abi.encode(SCRVUSD, 18))) // balanceOf(self)
Updates

Lead Judging Commences

0xnevi Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-ScrvusdVerifierV1-incorrect-storage-slot-balanceOf-compute

- Per sponsor comments, verified slot is vyper, solidity contract only verifies it. - Vyper computes storage slots different from solidity as seen [here](https://ethereum.stackexchange.com/questions/149311/storage-collision-in-vyper-hashmap)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.