Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Division by Zero in Price Computation

cipherhawk

Issue Description

The _raw_price function computes the price as:

return self._total_assets(parameters) * 10**18 // self._total_supply(parameters, ts)
​

Here, _total_supply is defined as:

def _total_supply(p: PriceParams, ts: uint256) -> uint256:
return p.total_supply - self._unlocked_shares(
p.full_profit_unlock_date,
p.profit_unlocking_rate,
p.last_profit_update,
p.balance_of_self,
ts,
)
​

If the unlocked shares become equal to or greater than p.total_supply—or if the supplied parameters are maliciously set—the resulting effective supply could be zero, leading to a division by zero error.

Impact & Attack Path

  • Denial of Service:
    If an attacker (or a misbehaving prover) can supply parameters that cause _total_supply to be zero, any call to _raw_price (and consequently update_price) will revert with a division error. This can halt price updates and disrupt dependent protocols.

  • Mitigation:
    The oracle should either validate that the effective supply is nonzero before performing division or include a fallback mechanism.

Recommendation

  • Add Check for Zero Supply:
    Before performing the division in _raw_price, add a require statement or conditional check to ensure that _total_supply(parameters, ts) is greater than zero. For example:

    supply: uint256 = self._total_supply(parameters, ts)
    assert supply > 0, "Effective supply is zero"
    return self._total_assets(parameters) * 10**18 // supply
    ​
Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

[invalid] finding-division-by-zero

Note that `total_supply` and `profit_unlocking_rate` is initially set to 1 and 0 respectively when the `ScrvusdOracleV2.vy` is deployed 1. `total_supply` and `profit_unlocking_rate` is part of the price param updates within `update_price`, which must have gone through verification via the OOS `StateProofVerifier` contract, so there is no evidence that a 0 supply is allowed either via a 0 supply update or an extremely high `profit_unlocking_rate`. 2. Since price is retrieved via values retrived from the V3Vault, if there is no supply, there is arguably no price to be posted. As such, reverting is arguably the correct choice since a 0 price value is not expected from scrvUSD, which is a stable coin.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.