Summary

Protocol has no way of updating priceFeedAddresses for given tokens, once assigned in the constructor.

Vulnerability Details

If the Chainlink address for a particular TOKEN/USD price feed changes tomorrow, the protocol has no way of updating this address. Something like the below should exist:

It should also have a time-lock (or delay) feature so that other users receive a heads-up that a priceFeedAddress update is going to happen in next few days. This avoids malicious use of the function by the owner.

In cases where the current price feed has not gone non-functional, and the above update is being done by the owner only to move to a better oracle, users can choose to redeem collateral during this 'delay' period.

Impact

If price feed address for any token in the protocol is changed by Chainlink, user funds are forever locked and lost.

Tools Used

Manual review

Recommendations

Add an updatePriceFeedAddressForToken function.