Summary

Protocol uses chainlink pricefeeds to get latest asset prices. Price feeds stored in s_priceFeeds mapping during the contract construction.

Vulnerability Details

There is no possibility to change pricefeeds addresses after the contract deployment. Should chainlink decide to redeploy them on other address, this protocol won't be able to update their value.

Impact

Protocol will effectively be dead and non of the user would be able to get their funds back.

Tools Used

Observation

Recommendations

Add function to change s_priceFeeds mapping. Consider using Timelock/Multisign or other safeguard for malicious pricefeed change