Missing Sequencer or Uptime Checker for Oracle Price Updates
Summary
The system relies on an oracle to provide price updates for scrvUSD. However, if the oracle goes down or fails to provide timely updates, the system could use stale prices, leading to incorrect trading or valuation of assets. A sequencer or uptime checker is needed to ensure that price updates are processed correctly and that stale prices are not used.
Vulnerability Details
The oracle is expected to provide price updates every 0.24 bps (basis points per second).
If the oracle fails or is delayed, the system continues to use the last known price (
last_price[i]), which could become stale.Without a sequencer or uptime checker, there is no mechanism to detect oracle downtime or switch to a fallback oracle.
Impact
Financial Losses: Trading or valuation based on stale prices could lead to financial losses for users.
Exploitation: Arbitrageurs could exploit the discrepancy between the actual price and the stale price.
Tools Used
Manual code review
Recommendations
Implement a mechanism to detect oracle downtime and trigger fallback behavior.
Switch to a secondary oracle if the primary oracle fails or is delayed.
Lead Judging Commences
[invalid] finding-missing-sequencer-check-stale-price
I believe this to be at best informational severity as - The moment sequencer is up again, the price updates that retrieve storage values from mainnet will be pushed. To note, price updates are retrieved from storage proofs are retrieved from Ethereum scrvUSD contract, so the concept of the next updated price being outdated is not possible, given mainnet does not utilize sequencers. - There are no problems with small lags if used in liquidity pools due to fees. Fees generate spread within which price can be lagged. - All price updates are subjected to smoothing, and as you can see from the historical price movements as seen [here](https://coinmarketcap.com/currencies/savings-crvusd/), there is never a large discrepancy in prices (absolute terms), and even more unlikely given sequencer downtimes will unlikely be long. This small price changes can be safely arbitrage aligning with [protocol design](https://github.com/CodeHawks-Contests/2025-03-curve?tab=readme-ov-file#parameters) , along with the above mentioned fees - Combined with the above, the max price increments can be temporarily increased to more effectively match the most updated price.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.